Bank of New York Mellon breach hits 4.5m customers

According to a statement released by Connecticut Attorney General Richard Blumenthal, a box containing between six and 10 unencrypted back-up tapes holding social security numbers, names and addresses - and possibly bank account numbers and balances - was lost in transit on 27 February.

Blumenthal says the missing box was one of 10 boxes that were being moved by truck by storage firm Archive Systems. It is thought the boxes were being transported from Bank of New York Mellon's shareowner services division to a storage facility. But when the vehicle arrived at its destination one of the boxes was missing.

In a letter to Stephen Dolmatch, general counsel, Bank of New York Mellon Shareowner Services, Blumenthal says the bank has informed him that the lock on the truck was broken and the vehicle was left unattended "several times".

In the letter, Blumenthal says: "The loss of this tape - so far unrecovered and unremedied - is inexplicable and unacceptable. It must be addressed by protective measures to forestall identity theft immediately."

The bank began notifying affected customers of the data loss six weeks ago and is offering them one year of credit monitoring through Equifax.

"Given this extraordinarily serious security breach, this offer of protection is grossly inadequate," says Blumenthal.

Blumenthal has asked the bank for more details on the breach and to outline what is being done to protect affected customers. The attorney has also asked the bank to provide details on measures being put in place to prevent future incidents.

"This security breach seems highly dangerous, indeed possibly devastating in light of the identity theft threat," says Blumenthal.

New of the Bank of New York Mellon breach follows the disclosure earlier this month that UK bank HSBC had lost a computer server holding the confidential personal details of around 159,000 customers from a branch in Hong Kong.

Furthermore, in January card issuer GE Money said a computer tape containing confidential information belonging to over 650,000 credit card holders had been lost. It was reported that the back-up computer tape was being held by data storage firm Iron Mountain. The firm told GE Money that the tape was missing from its warehouse in October 2007.

Meanwhile in the UK in January a box of files belonging to UK insurance group Prudential and including the banking details of 200 customers was found on a motorway slip-road after it apparently fell out of a courier's van.