Bank Loses 3.9M Customers' Data

CitiFinancial, the consumer finance division of Citigroup Inc., is notifying some 3.9 million U.S. customers that computer tapes containing information about their accounts - including Social Security numbers and payment histories - have been lost.

Citigroup, which is based in New York, said Monday the tapes were lost by the courier UPS, on their way to a credit bureau.

According to The Wall Street Journal, Citigroup says there is no evidence that the box of data tapes was stolen. It reportedly disappeared on the way from Weehawken, N.J., to a Texas office of the Experian credit bureau.

"Despite an exhaustive search for this package, we've been unable to find it," said Norman Black, a spokesman for UPS.

The bank said the tapes contain information about both active and closed accounts at CitiFinancial's branch network. It said they did not contain information from CitiFinancial Auto, CitiFinancial Mortgage or any other Citigroup business.

The statement said that CitiFinancial "had no reason to believe that this information has been used inappropriately, nor has it received any reports of unauthorized activity."

CitiFinancial said in its statement that the data loss "occurred in spite of the enhanced security procedures we require of our couriers."

It says there is little risk of the accounts being compromised because most customers have already received the loans to which the data refers, and no additional credit can be issued without the customers' approval.

In a letter to affected customers, the bank urges consumers to review activity on all their accounts to make sure nothing suspicious was occurring. CitiFinancial is arranging for all affected customers to sign up free of charge with a credit monitoring service for 90 days. Anyone who is victimized can get free help from Citigroup's Identity Theft resolution service.

Customers concerned about identity theft are advised to visit their local CitiFinancial branch or call 866-452-2484.

Debby Hopkins, chief operations and technology officer for Citigroup, said that the tapes were produced "in a sophisticated mainframe data center environment" and would be difficult to decode without the right equipment and special software.

Hopkins said that most Citigroup units send data electronically in encrypted form and that CitiFinancial data will be sent that way starting in July.

Citigroup, Hopkins told the Journal, ramped up security last year after an incident in February when personal data of about 120,000 Japanese customers fell out of a truck whose back door had been left open.

One of the new procedures she cites is a requirement that data shipments be processed by hand and not by bulk sorting systems. Hopkins told the Journal that a UPS worker in the CitiFinancial incident violated the rules when he scanned a "summary document" instead of the individual boxes, making the now-missing box hard to trace.

The missing CitiFinancial customer data is the latest in a series of data losses or breaches that have forced financial institutions and other data collectors to warn customers that their personal information may be at risk.

Last month, media and entertainment company Time Warner Inc. said that computer backup tapes containing data on 600,000 individuals were lost by an outside data storage firm.

The data covered current and former employees going back to 1986, as well as some of their dependents and beneficiaries, the company said. It did not include personal data on Time Warner customers, the company said.

Also in May, more than 100,000 customers of Wachovia Corp. and Bank of America Corp., both headquartered in Charlotte, North Carolina, were notified that their financial records may have been stolen by bank employees and sold to collection agencies. And in April, Ameritrade Holding Corp., a leading online discount broker, said it had informed some 200,000 current and former customers that a backup computer tape with personal information had been lost.

Kevin Kessinger, executive vice president of Citigroup's Global Consumer Group and president of Consumer Finance North America, told The Associated Press that the tapes left CitiFinancial on May 2 and were discovered missing on May 20. Senior managers were notified May 24.

The Secret Service was told of the loss of the tapes on May 27 and began investigating.

Kessinger says notification of customers was delayed at the request of the Secret Service.

U.S. Rep. Edward Markey, a Democrat from Massachusetts and co-chairman of the Congressional Privacy Caucus, said the CitiFinancial data loss underscores the need for Congress to regulate information brokers.

"This episode of identity data loss is, unfortunately, becoming all too common," Markey said in a statement. "To address this problem, I have introduced legislation - the "Information Protection and Security Act" - which would subject information brokers to federal regulation by the Federal Trade Commission and require such brokers to comply with a set of new fair information practice rules."

"Clearly we regret that this happened with our customers," Kessinger said. "We're trying to be upfront - to communicate and to talk about what the issues are."