Citigroup, the world's largest bank, has lost the account and payment history data on 3.9 million of its customers.
The company said the details were lost in transit by United Parcel Service (UPS). The loss is the latest potential identity theft scare to hit major US companies, including Time Warner, MCI, ChoicePoint, and Lexis-Nexis.
The loss affects customers of the company’s CitiFinancial branch network. The personal information was on computer tapes that were lost by UPS while in transit to a credit bureau.
The tapes contained unencrypted information about CitiFinancial branch network customers in the US, as well as customers with closed accounts from CitiFinancial Retail Services.
The tapes did not contain any customer information from any other Citigroup business.
CitiFinancial said it had no reason to believe that the information has been used inappropriately, nor has it received any reports of unauthorised activity, so far.
“We deeply regret this incident, which occurred in spite of the enhanced security procedures we require of our couriers,” said Kevin Kessinger, executive vice president of Citigroup's global consumer group.
“There is little risk of the accounts being compromised because customers have already received their loans, and no additional credit may be obtained from CitiFinancial without prior approval of our customers, either by initiating a new application or by providing positive proof of identification. Beginning in July, this data will now be sent electronically in encrypted form,” said Kessinger.
“Customer security is of paramount importance to Citigroup,” said Debby Hopkins, chief operations and technology officer at Citigroup.
“While this incident affects the customers of only one of our businesses, we put significant effort into assuring that our data protection procedures meet and exceed industry standards at all of our businesses, and are reviewing the issues here as part of this ongoing effort.”
Ironically, before the loss of the tapes, Citigroup had announced an aggressive legal campaign against identity thieves by partnering with district attorneys across the US.