Bank data loss could affect 10 million customers

Gov. M. Jodi Rell announced Aug. 28 that the state's investigation into the loss of confidential data of more than 500,000 Connecticut residents by the Bank of New York Mellon Corp. has revealed that the security breach is much broader than first reported.

The Connecticut consumers were among 4 million people whose data was lost in February when BNY Mellon was transferring information, some on behalf of People's United Bank of Bridgeport.

"It is simply outrageous that this mountain of information was not better protected and it is equally outrageous that we are hearing about a possible six million additional individuals and businesses six months after the fact," Rell said. "We fear a substantial number Connecticut residents are among this latest group."

The sensitive data includes names, addresses, dates of birth and Social Security numbers. BNY Mellon did not notify People's until May 13 that information on 556,000 People's depositors, was missing.

The most recent figures came in response to the subpoenas that Governor Rell had ordered be issued in May by the state Department of Consumer Protection.

BNY Mellon informed the state that it will begin the process of notifying these additional customers today. Under Connecticut state law, banks are required to immediately notify customers when such information is lost.

"Had the hundreds of thousands of Connecticut residents affected been notified immediately that their data had been compromised, they could have taken steps to protect themselves," the governor noted. 

Rell has directed Consumer Protection Commissioner Jerry Farrell, Jr. to continue to work with Attorney General Richard Blumenthal and pursue "all remedies available" under Connecticut law against BNY Mellon, including seeking a substantial fine, restitution to consumers and other penalties.

She also directed Farrell to meet with BNY Mellon leadership and insist the bank extends the same identity protection to the additional Connecticut residents. BNY Mellon is currently providing free identity theft protection for the Connecticut residents initially affected.

Farrell said the DCP subpoenas sought details about the extent of the data breach, the timeline and conditions surrounding the tape loss, copies of any law enforcement or security reports filed following the loss, the names and addresses of all Connecticut customers whose names were included in any of the missing files and other pertinent facts.

"Nothing in the data we were given in May and June by BNY Mellon indicated in any way that these additional six million individuals and businesses were involved," Farrell said."This certainly raises serious additional questions about how secure personal identifying data is at the Bank of New York Mellon and widens the scope of our investigation."

Rell also called upon the federal government to tighten steps to prevent security breaches and enforce existing laws against violators.

"The vast dimensions of this data breach affect not only hundreds of thousands of individuals and businesses in Connecticut, but millions across our nation," the governor said.