The Columbia Tribune and AP reported Sunday:

Also on Sunday, Strickland said the device contained the names and case numbers of the state's 84,000 welfare recipients, who face "a remote threat of identity theft," and the names and federal tax identification number of vendors that receive payroll deduction payments from the state - about 1,200 records. Sixteen of those records contain banking information, he said.

The Springfield News Sun also noted:

Strickland issued an executive order to change the policy that made the intern one of the employees permitted to take the backup tape home for security purposes.

At this point we can say (and it has been said) that the Govenor is closing barn door after.... OK, that's true. Unlike another well publicized data breach, at least Ohio officials aren't running away from this one.

The Toledo Blade reported (before the expanded breadth of the theft was reported) that:

The state is offering free identity-theft monitoring to all 64,467 employees of state and legislative offices, boards, and commissions for one year at a total cost to taxpayers estimated at $660,000.

So at a minimum, the cost of the theft of a $15 data device is $660,000. This example will drive home the point that it's not the cost of the device but the value of the information that needs to be considered when formulating security policies. This is a good time to for all of us to take another look at our risk analysis assumptions.