Bank's Lost Backup Tapes Contained IDs of 12 Million

Via DarkReading -

The Bank of New York Mellon said yesterday that the backup tapes that were lost by its courier earlier this year may have included personal information on 8 million more people than the initial 4.2 million it originally announced.

The unencrypted storage tapes from BNY Mellon Shareowner Services were lost by a courier earlier this year while transporting the tapes to an offsite storage location. A forensics investigation of the breach determined that there was significantly more sensitive data on the tapes than first thought.

“When we announced [the lost tapes] back in May, we said we were going to do a top to bottom review across the company and go back and review it again,” a Bank of New York Mellon spokesperson said. “When we discovered [there was] this additional data that may have non-public personal data on it, we brought in a third party” to help investigate it, the spokesperson said.

The individuals whose names, addresses, and Social Security numbers were on the tapes are clients of BNY Mellon Shareholder Services, which provides administrative support to employee stock purchase programs, as well as other financial services. The bank is currently notifying these additional individuals, and has set up a Website for victims for information and updates.

The Bank of New York Mellon maintains that there’s been no evidence of abuse of the exposed personal data thus far. It is offering to the affected individuals two years of free credit monitoring; $25,000 in identity theft insurance with no deductible; and reimbursement for some credit freeze costs.

Meanwhile, the bank has been doing some in-house security rehabilitation, including an outside review of its policies, procedures, and controls, and moving to electronic, encrypted transmission of stored data where possible rather than the use of storage tapes. It’s also conducting employee education and awareness on data security.

--------------------------

OMG, I love this sentence..."A forensics investigation of the breach determined that there was significantly more sensitive data on the tapes than first thought."

You think? When have you ever seen it the other way around? Sensitive folders or tapes that don't actually have sensitive information in them? Never. lol

Yes, I know. Backup tapes aren't as go-and-grab thief friendly as unencrypted laptops and PDAs, but a serious attacker could get the information off. But lets forget the tapes for a second.

Where did the data come from? The information is coming from a system. A system which clearly contains a ton more sensitive data than the admins even know - perhaps stored on the system unencrypted.

Do you think that is the only server on the network that have unknown / unencrypted sensitive information on it? Highly Doubtful.

So, losing the tapes isn't good...clearly. But that simple sentence points to the possibility of more serious issues in overall information management - way beyond the tapes.