Why would a network engineer route all of his employer’s traffic through his home RoadRunner cable modem? “You can direct where your traffic is going, and we found out that he’d sent the traffic home to ensure that his routing patterns at work were correct,” Saccavino told InformationWeek in a recent interview. But after a week, Saccavino said, he’d forgotten to turn it off.
During the week or so in 2005 that all brokerage traffic was being piped through the home router, the data being sent by GunnAllen’s 200 or so employees included bank routing information, account balances, account and social security numbers, and customers’ home addresses and driver’s license numbers, says Roger Sago, a former Revere Group SQL Server database administrator who was working at the GunnAllen offices at the time. Sago was in charge of defining the data stream to and from Pershing (a unit of Bank of New York Mellon that provides prime brokerage and other services to financial services organizations), which involved thousands of transactions per day. “They transmitted it over the system, online, to the clearinghouse, and if anyone had access to that data … the ramifications would be huge,” Sago said. “There’s enough data there that a person could run off and live forever off of what they found.”