Bank's Lost Backup Tapes Contained IDs of 12 Million Clients

The Bank of New York Mellon said yesterday that the backup tapes that were lost by its courier earlier this year may have included personal information on 8 million more people than the initial 4.2 million it originally announced.

The unencrypted storage tapes from BNY Mellon Shareowner Services were lost by a courier earlier this year while transporting the tapes to an offsite storage location. A forensics investigation of the breach determined that there was significantly more sensitive data on the tapes than first thought.

“When we announced [the lost tapes] back in May, we said we were going to do a top to bottom review across the company and go back and review it again,” a Bank of New York Mellon spokesperson said. “When we discovered [there was] this additional data that may have non-public personal data on it, we brought in a third party” to help investigate it, the spokesperson said.

The individuals whose names, addresses, and Social Security numbers were on the tapes are clients of BNY Mellon Shareholder Services, which provides administrative suport to employee stock purchase programs, as well as other financial services. The bank is currently notifying these additional individuals, and has set up a Website for victims for information and updates.

The Bank of New York Mellon maintains that there’s been no evidence of abuse of the exposed personal data thus far. It is offering to the affected individuals two years of free credit monitoring; $25,000 in identity theft insurance with no deductible; and reimbursement for some credit freeze costs.

Meanwhile, the bank has been doing some in-house security rehabilitation, including an outside review of its policies, procedures, and controls, and moving to electronic, encrypted transmission of stored data where possible rather than the use of storage tapes. It’s also conducting employee education and awareness on data security.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.