When Laptops Thefts Hit, Retailer Did More than Most to Investigate

More than just notification letters about data beach, company put private investigation in works

The company immediately reported the thefts to the San Francisco Police Department, the insider said, and was frustrated to learn that the police weren't hopeful that the missing laptops would be recovered.

"We decided we needed to do whatever we could within the law," the insider said. "We wanted to get those laptops back."

In her statement, Gymboree's Armstrong said that "after reporting the theft to the police, we researched our options and decided to hire a private investigator to also look into the theft."

She added: "The investigator has provided the information that he has collected to the police and is currently working with them on their ongoing investigation."

The insider said the investigator spoke with other businesses in the vicinity and determined that the same person may have been responsible for a series of laptop thefts in the SoMa area.

A spokesman for the San Francisco Police Department confirmed that police have been working with the investigator hired by Gymboree. He said detectives had been asked by the investigator to provide the name of a suspect arrested for trespassing in the SoMa area several years ago.

The spokesman acknowledged that the investigator believes the suspect from the earlier trespassing case is connected to the Gymboree thefts.

"However," the spokesman said, "our burglary section can find no physical evidence to link that person to being the Gymboree thief."

The Gymboree insider said the company is satisfied that at least it attempted to find the thief and recover its laptops in a timely fashion.

"We've done what we felt we needed to do," the insider said. "We wanted to make the effort."

Gymboree's Marina said the company has introduced a variety of security measures as a result of the incident. "Prior to the theft," she said, "we had begun encrypting all company laptops and have now completed this process."

Gymboree also has provided free credit monitoring to an undisclosed number of employees deemed most at risk of identity theft because of the missing laptops.

Walsh, the Bay Area private investigator, is playing no role in the Gymboree case but sees this as further evidence that businesses will increasingly seek outside help when sensitive data go astray.

"Companies can't wait for a police investigation to get going," he said. "That's why they're turning to private investigators."

Larry Ponemon of the Ponemon Institute agreed that use of private investigators in data breaches will continue to grow.

"Law enforcement is way too busy to deal with every stolen laptop," he said. "So we're going to see more and more companies feeling that they have to bring in their own muscle."