Government security workers warned of identity theft risk

No company likes to admit that it has had a security breach. But things must feel even more awkward when the victim company is a computer security contractor working for the US federal government.

SRA International, a government contractor that provides cybersecurity services, has admitted that computer malware found on its computer network may have stolen personal information about its employees.

The unnamed malware was found on a network server also used for storing employees' names, addresses, dates of birth, health information and social security numbers. The firm has informed its staff by letter of the security breach, and advised that they are offering credit monitoring services to employees concerned that they may become victims of identity theft.

SRA letter

I guess the big unanswered question is this: Why wasn't this sensitive data encrypted? If it had been securely encrypted then even if malware and hackers had gained access to the same drive as the confidential information, they wouldn't be able to do anything with it.