Thief nets personal information from Kalispell company

About 9,000 people have been notified that some of their personal information was taken from the Merlin Information Service's database in Kalispell.

Among the victims are 13 Montanans; four are from the Flathead Valley, according to the company.

None of the data was medical or credit information, such as credit-card or banking-account numbers, according to Keith Brown, CEO of Merlin. It was limited to names, addresses, and Social Security numbers, he said.

"We are very concerned for these individuals," Brown said. "We view this situation as very serious."

There is no indication that anyone's personal information has been misused, he said.

The company notified the people involved and pledged its assistance to "do everything we can to help you resolve any problems that may arise from this incident," according to a letter from Michael Dores, Merlin's president and founder.

The company is working with the Office of the Inspector General of the U.S. Postal Service and the F.B.I. to help with its investigation. Together they were able to identify a person who used fake credentials to

qualify as a legitimate business to gain access to the Merlin system.

The company's service is "helping people locate people," Brown said.

It is used by investigators, collection agencies, insurance companies and government entities to search databases of public records.

Brown said the company's information is also used privately for things like locating people affected by product safety recalls, locating lost loved ones, looking for assets, and running background checks.

The company was notified on March 28 by the postal inspector of an investigation into someone pretending to be a legitimate customer of Merlin's. The company found the same person had opened another account on April 5 as a supposed investment services company. Merlin shut down both accounts.

Brown said the person involved lives outside Montana. Federal agents know who it is, he said.

"We believe we're close to cracking the case," Brown said.

He said he doesn't know why the 9,000 people involved were culled out of the database.

"There is not a common denominator we are able to deduce," he said. Many of the people involved live in California, he said. Some are in Guan, Puerto Rico and the Virgin Islands.

Meanwhile, he said, the company is extending help to everyone whose data was compromised and to make sure it doesn't happen again.

Each of the affected individuals can sign up for free credit monitoring for one year with Experian(R), one of the nation's leading consumer credit reporting agencies. That will give them a daily alert to any changes on their credit report.

Merlin also arranged for $50,000 of ID Theft Insurance from Virginia Surety Company, Inc. for each person to cover any actual damages that they may result from the crime.

"We are making every attempt to ensure the process is as simple, efficient, and effective as possible," Brown continued. Merlin has set up a consumer website and a consumer hotline with information on numerous ID theft resources.

For more information, go to merlindata.com/pressroom

Merlin has also toughened its procedures to certify potential customers, Brown said. Now, in addition to the credentials required to obtain access to Merlin's systems, all businesses that apply for access to non-public information must also pass a physical site inspection of their place of business, he said.

Dores' letter to the individuals concluded with this comment, "Please accept my personal apology for any distress that this incident may cause you. As a business owner, I have been personally committed to ensuring that Merlin has exceeded the industry's privacy, security and fair information practices standards throughout our 14 year history. I can also assure you that we have further tightened our security and client qualification procedures so that this type of incident does not reoccur."