State officials try to determine scope of bank breach | SC Media

State officials try to determine scope of bank breach

May 23, 2008
Connecticut Gov. M. Jodi Rell announced on Friday that she is directingthe state consumer protection commissioner to issue another twosubpoenas in connection to the lost Bank of New York Mellon backup tape, which contained the unencrypted personal information of an estimated 4.5 million customers.

The subpoenas will be issued to Charlotte, N.C.-based Wachovia andConnecticut-based Webster Bank, said the governor, who already hasordered the issuance of subpoenas to People's United Bank and Bank ofNew York Mellon.

"Any of the banks that were selected have been identified asinstitutions that had information that were breached or potentiallybreached when the tape went missing," Rich Harris, a spokesman for thegovernor, told SCMagazineUS.com on Friday. "It's an informationgathering process. It's not intended to point fingers at anyone."

He said the purpose of the subpoenas is to determine the scope of thebreach and whether any laws were violated when the tape went missingthree months ago.

Harris said he did not know the relationship between Wachovia and Webster banks and Bank of New York Mellon.

People's United Bank has already acknowledged it provided Bank of NewYork Mellon with customer information so it could offer consumers aninvestment opportunity, the Connecticut Attorney General's Office hassaid.

"Wachovia has called here to say they did not lose any customer data,but they did lose employee benefit information," Harris said.

He did not know about Webster Bank. A Webster Bank spokesman did not respond to a request for comment on Friday.

Ronald Sommer, a Bank of New York Mellon spokesman, toldSCMagazineUS.com on Friday that the company cannot comment on otherfinancial services firms whose customer data may have been on the tape.

"We cannot speak to client relationships," Sommer said. "It's hugely frustrating to bein the midst of a situation where other parties are speaking to ourclient relationships, but we can't address them. As onerous as I know itsounds, we have to defer to our clients. That's their decision to makewhether they want to acknowledge their involvement."

Rell said in a statement that she is also upset by the delay innotifying victims about the breach. The missing tape was in possessionof records management firm Archive Systems, charged with moving thedata to a storage facility, when it went missing Feb. 27, Connecticutofficials have said. Nine other tapes safely arrived at theirdestination.

Bank of New York Mellon has since severed ties with Archive Systems andcontracted with a new data archiving service provider, Sommer said.

"I am gravely concerned by the unacceptable delay between the loss ofinformation and the notification to affected customers," Rell said."The possibility that customers of additional banks are affected onlyadds to the problem."

Bank of New York Mellon said Thursday in a statement that upon learningof the lost tape, it immediately contacted authorities and launched aninvestigation.

The bank plans to offer one year of free credit monitoring to victims. So far, none of the data has been misused, the bank said.

Sommer said company policy required the data to be secured, although itdid not necessarily mandate encryption. The bank is reviewing itspolicies.
prestitial ad