Backup Tapes, Encryption Important, Iron Mountain Says

Iron Mountain Inc. is advising its customers that current, commonly used disaster recovery processes do not address increased requirements for protecting personal information from inadvertent disclosure. In recent months, several companies have disclosed incidents that may have compromised personal information. While most of these cases involved malicious, online identity theft, some of the events were due to the accidental loss of computer backup tapes.

"The accidental loss of backup tapes poses a potential risk if sensitive information stored on those tapes is unencrypted. Since Iron Mountain stores and manages backup tapes for many major companies around the world, we have fielded questions in recent weeks about these issues. It is our policy not to discuss any specific customers, but given the magnitude of our business, we're obviously not immune from this type of occurrence. Therefore, we want to broadly address these questions and share our perspective on this important issue," said Richard Reese, Chairman and CEO, Iron Mountain. "Iron Mountain is not aware of any incident in which the physical loss of a backup tape resulted in the unauthorized access of personal information. It is important to understand that unencrypted information stored on backup tapes is difficult to read, but it is not impossible. Companies need to reassess their backup strategies and seriously consider encrypting sensitive data to prevent a potential breach of privacy."

Iron Mountain performs around five million pick-ups and deliveries of backup tapes each year, with greater than 99.999 percent reliability. Nevertheless, since the beginning of the year, four events of human error at Iron Mountain resulted in the loss of a customer's computer backup tapes. While four losses is not a large number in comparison to an annual rate of five million transportation events, any loss is important to customers and to Iron Mountain.

"We invest more in training, automation and process controls than anyone in our industry," added Reese, "But even Iron Mountain is not immune from human error. The only effective means to prevent unauthorized access to data is the use of encryption."

"Iron Mountain, therefore, is recommending that companies encrypt backup tapes containing personal information, but take care to incorporate encryption in a way that does not compromise their overall disaster recovery plans," advised Reese. "This announcement is the beginning of a campaign to educate our customers on these important issues so that together, we can start to work toward solutions."