Companies on lost bank computer tape identified

June 4, 2008
Lost data tape contained information on nearly 500,000 Conn., residents

The missing Bank of New York Mellon computer tape reported last week contained information about nearly 500,000 Connecticut residents from a large number of companies, said state officials, who identified 25 of the companies on Friday.

New York Mellon, which was responsible for the tape, has upped its fraud protection offer from one year to two years. The company has agreed to provide two years of free credit monitoring, including $25,000 in identify theft insurance and free credit freezes to people affected by either security breach.

New York Mellon had been under pressure from Attorney General Richard Blumenthal and other Connecticut officials to boost its protection offer. Among the 497,333 Connecticut residents affected, 403,894 were depositors of People's United Bank, which said last week it is relying on New York Mellon to notify its depositors.

Other companies affected were John Hancock Financial Services Inc., 33,586 shareholders; and The Walt Disney Co., 18,361 shareholders. The rest had fewer than 10,000 Connecticut residents.

The list of companies was provided by New York Mellon and released by Blumenthal and Jerry Farrell Jr., commissioner of the Department of Consumer Protection.

The unencrypted computer tape was lost Feb. 27 by a third-party courier, which was transporting it on behalf of Mellon's Shareowner Services business. Mellon did not inform People's of the loss until earlier this month.

The loss potentially puts millions of people at risk for identity theft and bank account and credit fraud. In all, the tape contained personal and financial information of 4.5 million people nationwide, from more than 700 companies and other institutions - including Mellon itself. The names were those of shareholders of the companies, or in the case of some of the banks, depositors who had some of the legal rights of shareholders.

People affected by the breach should receive or have already received a letter from Bank of New York Mellon informing them of the loss and instructions on signing up for the free credit protection services, Blumenthal said.

However, he urged Connecticut residents who believe their information may be on the tape to call one of New York Mellon's two toll-free numbers, 877-278-3451 or 877-278-3461, and to be vigilant in monitoring their bank accounts and credit cards.

New York Mellon has been soundly criticized by People's United officials and state officials for failing to report the full extent of the security breach until May 18.

Officials with The Bank of New York Mellon said Friday that there are no indications that the data on the lost tape has been accessed or misused in any way. They said they are in the process of notifying anyone involved in the security lapse.

"We deeply regret that this occurred and sincerely apologize to all of those impacted," Todd Gibbons, chief risk officer at New York Mellon, said Friday. The company said it plans to upgrade its security measures.

New York Mellon was in possession of the People's United Bank data because it was assisting the parent of the Bridgeport-based bank with its conversion to a fully public company. People's was required to allow all of its depositors the opportunity to vote on the conversion. New York Mellon tabulated depositor votes and processed stock order requests.

Officials with New York Mellon said that when they learned of the breach, they notified the Office of the Comptroller of the Currency, the New York State Banking Department, the Federal Reserve Board, the Securities and Exchange Commission and law enforcement agencies.

However, Blumenthal said his office is continuing its investigation into why it took New York Mellon more than eight weeks to alert the affected institutions of the breach, which he described as "massive, inexplicable and inexcusable."

Some Connecticut residents, including Bruce Sylvester of Hamden, say they are having trouble obtaining information from New York Mellon as to whether their personal information is included on the missing tape.

"My wife and I have the same account," Sylvester said Friday. "We called up Mellon the same day and got two different answers as to whether our information was on the tape."

This week, New York Mellon also revealed a second security breach in which a computer data storage tape containing the images of scanned checks and other documents was lost in late April as it was being transported from Philadelphia to Pittsburgh.

"We are only now getting our arms around this much smaller incident," Bank of New York Mellon spokesman Ron Sommer said Friday. "I don't know if it involves Connecticut residents."

The second breach affects 47 institutional clients, company officials said.

Last week, several customers of People's United Bank filed suit over the data breach. The lawsuit, which seeks class-action status, was filed in Superior Court in New Haven against both People's United and The Bank of New York Mellon.

Mike Stratton, a New Haven attorney representing those suing the banks, described New York Mellon's latest offer of two years of credit protection as inadequate.

"The Bank of New York Mellon is acting with an incredible amount of gall," Stratton said Friday. "First, they recklessly lose the personal information of 4 million people, they then hide it from public view."

Stratton said Mellon must provide "at least seven years of credit monitoring and credit insurance."

The 25 companies identified Friday are: Bank of New York Mellon Corp., People's United Financial Inc., John Hancock Financial Services Inc. , The Walt Disney Co., TD Bank Financial Group, Hudson United Bancorp, United Parcel Service Inc., Wachovia Corp., MetLife Inc., Hudson City Bancorp, Eastman Kodak Co., Burlington Resources, Providian Financial, Penn Fed Financial, ADESA Inc., Alcatel-Lucent, Odyssey America Reinsurance Corp., Seacoast Financials Services Corp., Viewpoint Bank, Diamond Shamrock, Sound Federal Bancorp, Big Lots Inc., Guidant Corp., New York Community Bancorp and ACE Ltd.