What Every Wells Fargo Investor Needs To Know

From: James Dorrian On Behalf Of Information Security Sent: Wednesday, August 22, 2007 9:01 AM To: FNFS_ALL Subject: Information Security Reminder: Sharing Credentials, Removable Media, Paper Documents

Good afternoon, There are a couple of security topics that need to be addressed this month: Sharing of Login Credentials Recently it was discovered that several employees were sharing login credentials (username and password) for an external system. Username and password information should NEVER be shared between users. If one of the people logging in under that account chooses to do something malicious, the blame could fall to the wrong individual. If another person gains access somehow then the difficulty in finding the correct offender becomes more difficult. Treat your username and password as your driver’s license; you wouldn’t loan it to a coworker.

Removable Media (USB thumb drives, CDs, etc) To every extent possible, removable media should not be used. If using removable media is the only option, it should have the ability to be encrypted. No customer sensitive data should ever be stored on removable media. As noted by the recent incident listed below, the loss of a single USB storage device can result in the compromise of thousands of people’s sensitive information. August 7, 2007

Merrill Lynch A storage device apparently was stolen containing (Hopewell, NJ) sensitive personal information, including Social Security numbers, about some 33,000 employees.

Hard Copy (Paper) Documents Reports of customer sensitive information including loan numbers, debtor’s information, or other personally identifiable information (PII) should never leave our facilities. Even within our facilities hard copy documents should be protected appropriately by storing them in a locked drawer or file cabinet. When the document is no longer needed, it must be placed in a shred bin for proper disposal. July 19, 2007 Cricket Documents stolen from store result in loss of 300 Communication credit card numbers. s August 1, 2007

Lifetime Fitness Staff had discarded customer records in easily (Dallas, TX) accessible trash cans behind the businesses. Information that was discarded contained names, addressed, Social Security numbers and credit card information, as well as the date of birth of several children.

As always, please let me know if you have any questions or concerns. V/r, James M. Dorrian Assistant Vice President – Security and Compliance FIS LPS Technology Solutions (904) 470-7899 (W) (904) 524-6027 (C)