Elizabeth Rosen was plenty angry when ChoicePoint Inc. sent her a form letter acknowledging that crooks might have perused some of her most sensitive personal and financial data.
But the Hollywood nurse was flabbergasted when the company, one of the nation's largest collectors of consumer records, also offered to sell her some of the same information so she could see what might have been compromised.
Rosen was among the 150,000 people whose records were released to identity thieves who scammed their way into ChoicePoint's databases, which the company says constitute the largest private collection of court records, Social Security numbers and other public and personal data in the country.
Insurance companies, banks, law enforcement agencies and many arms of federal and local governments buy information from ChoicePoint to perform background checks on potential clients, tenants or employees. Now the Alpharetta, Ga., firm is finding a lucrative new business charging consumers worried about identity theft for access to their own criminal, education and employment histories.
"They sold information on me to criminals," Rosen said, "but they're not sharing it with me."
Rosen's experience highlights a paradox in the recent string of thefts of personal information: Many of the same companies responsible for safeguarding reams of sensitive data that have fallen into the hands of scammers are now trying to cash in by pledging to protect consumers' privacy.
Information brokers infiltrated by con artists, banks that have lost unencrypted financial data and peddlers of online background checks are pitching fraud-detection plans that cost from $25 a year to more than $150.
The companies offering these services say they provide real value. But victims of identity theft and consumer advocates complain that ChoicePoint, the major credit bureaus and others are reaping the benefits of their own lapses and, in some cases, recklessness. They say there's little incentive for sellers of personal data to tighten security when they profit from people worried that they'll be among the 10 million annual victims of identity theft.
Critics such as Gail Hillebrand, an attorney for Consumers Union, which publishes Consumer Reports magazine, contend that the data brokers and banks fuel identity theft by marketing all manner of information and by offering easy credit without screening applicants to ensure that they are who they say.
"It's certainly wrong to be only selling protection for a problem you helped create without also working actively to solve that problem," Hillebrand said.
Because of the data breaches, some banks are working harder to authenticate the people behind transactions, while ChoicePoint and other information brokers are cutting back on the types of data they offer. And during the spate of high-profile breaches that followed ChoicePoint's disclosures, lawmakers began debating legislation aimed at forcing the companies to clamp down further.
In the meantime, however, the credit bureaus and others are hyping their anti-fraud offerings, in some cases deceiving consumers as they take in millions of dollars for credit monitoring, identity-theft insurance and other services.
Those products can help "level the playing field," said Silicon Valley information technology analyst Rob Enderle. "Historically, other people have been able to get huge amounts of information on you, and you haven't had easy access."
Nonetheless, some question the value of such services.
Few people who have false charges rung up in their names are held financially responsible. Federal law entitles consumers to a free credit report every year from each of the three major bureaus. In California and some other states, consumers can put a freeze on their credit records to deter fraud. Consequently, experts say most people don't need special insurance or credit monitoring, which checks whether new loans have been sought in their name.
"They're peddling fear," said Pam Dixon, executive director of the nonprofit World Privacy Forum.
Billions of records about virtually every adult in the country are maintained by an array of companies. Among the most familiar are the credit bureaus that have long tracked debts and payment histories. Less familiar, though, are data brokers such as ChoicePoint, which aggregate other personal information and operate with fewer restrictions. And, increasingly, banks and credit card companies maintain considerable data caches on their customers.
All trade information back and forth. The credit bureaus and data brokers also sell their information. The growth in so-called data mining is made possible by the digitization of records, which makes it cheaper and easier to collect, store, retrieve -- and even steal -- sensitive information.
Among those benefiting from heightened worry is ChoicePoint, which acknowledged in February that scam artists had used its system to gain access to credit reports and other records on people.
