One of the investigators working on the breach has told the New York Times that the attack was both simple and ingenious.

The NYTimes source, billed as a "security expert familiar with the investigation", said the attackers logged on to the part of the bank's site reserved for credit card customers - and substituted their own account numbers which appeared in the browser's address bar with other numbers. Using a computer-based random number generator, the hackers created tens of thousands of possible account numbers, which opened the door to the profiles of other customers.

Citi confirmed the breach last week, saying that names, account numbers and e-mail addresses had been compromised but not birth dates, social security numbers and card security codes, which are held elsewhere.

Thieves found Citigroup site an easy entry - New York Times

Finextra verdict: If true - and the NYTimes is careful to mask its source - this a truly embarrassing security failure for Citi. Inserting customer account numbers into the visible display bar on the browser is a basic error. Heads must roll.