News
Consumer Protection to probe lag between data theft, notification of bank customers
By Governor Rell's office
May 22, 2008 - 4:48:07 PM

Governor M. Jodi Rell today announced that, at her direction, Consumer Protection Commissioner Jerry Farrell Jr. has issued subpoenas to Bank of New York Mellon Corp. (BNY Mellon) and People’s United Bank of Bridgeport (People’s). The subpoenas seek information about the loss of a computer tape containing personal and financial data on millions of consumers, including more than half a million depositors in Connecticut.

The data – lost when BNY Mellon was transferring the information on behalf of People’s – includes names, addresses, dates of birth and Social Security numbers. It was lost in late February.

Under Connecticut state law, banks are required to immediately notify customers when such information is lost. Yet BNY Mellon did not notify People’s of the breach until March 18, at which time it said information on about 170 shareholders was missing. It was not until May 13 – some eight weeks later – that BNY Mellon advised People’s that information on some 556,000 depositors was missing.

“The disastrous effects of identity theft are virtually instantaneous in today’s computerized world, and the lag time between the theft and the notification only aggravates what is an already outrageous situation,” Governor Rell said. “For a major financial institution such as Bank of New York to lose such a massive amount of customer data is utterly unacceptable. To delay reporting the loss to appropriate authorities and potential victims for more than three months is not only irresponsible but shows a callous disregard for customers.

“These key pieces of personal information – names, birthdates and Social Security numbers – are exactly the pieces of information that identity thieves need most,” the Governor said. “Consumers should have been notified immediately so they could take steps to protect themselves.”

The DCP subpoenas seek details about the extent of the data breach, the timeline and conditions surrounding the tape loss, copies of any law enforcement or security reports filed following the loss, the names and addresses of all Connecticut customers whose names were included in any of the missing files and other pertinent facts.

“Issuing this subpoena is the first step in investigating what laws may have been broken,” DCP Commissioner Farrell said. “We are specifically interested in whether Mellon and People’s complied with the section of Connecticut state law that requires financial institutions to report data breaches.”

Governor Rell noted that she proposed major changes to Connecticut law pertaining to identity theft during the recent legislative session.

“Unfortunately, the Legislature did not enact those reforms,” the Governor said. “Those changes would have addressed situations like this, where a major corporation loses the personal identifying information of its customers. I am asking Commissioner Farrell to take what elements of my proposal that can be enacted as regulations and put them into effect as soon as possible. The consumers of Connecticut cannot afford to wait another year for effective identity theft protections.”

© Copyright by NorwalkPlus.com