Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security Privacy News

Bank of NY Loses Tapes With 4.5 Million Clients' Data 156

Lucas123 brings news that Bank of New York Mellon Corp. has admitted they lost a box of unencrypted data storage tapes. The tapes contained personal information for over 4.5 million people. From Computerworld: "The bank informed the Connecticut State Attorney General's Office that the tapes ... were lost in transport by off-site storage firm Archive America on Feb. 27. The missing backup tapes include names, birth dates, Social Security numbers, and other information from customers of BNY Mellon and the People's United Bank in Bridgeport, Conn., according to a statement by Connecticut Attorney General Richard Blumenthal.
This discussion has been archived. No new comments can be posted.

Bank of NY Loses Tapes With 4.5 Million Clients' Data

Comments Filter:
  • Unencrypted? (Score:5, Interesting)

    by cephah ( 1244770 ) on Saturday May 31, 2008 @05:15AM (#23608261)
    I thought you had an obligation to encrypt data containing sensitive personal information such as SSNs when transporting them? In Denmark you are required by law to store such data safely, I wonder if it's any different in the US.
  • by Anonymous Coward on Saturday May 31, 2008 @05:26AM (#23608293)
    Well, once 4.5 million people have sued them for breaching their privacy through negligence there really isn't much point staying open is there. Or we could have some fun and teach them a lesson the old fashioned way, run on the bank anyone?
  • by 3seas ( 184403 ) on Saturday May 31, 2008 @06:07AM (#23608373) Homepage Journal
    digital diarrhea...

    So what exactly is homeland security about? Its obviously not about protecting US citizens.

    As a government body, shouldn't homeland security be involved in helping to prevent such digital leakage, even if just setting down the rules to follow and pursuing violators of the rules?
  • Always... (Score:2, Interesting)

    by owlnation ( 858981 ) on Saturday May 31, 2008 @06:12AM (#23608391)
    It's important to remember things such as this when the usual brainwashed-by-Fox conservatives say stuff like: "if you've nothing to hide, they why are you worried about privacy".
  • really? again? (Score:3, Interesting)

    by knight0wl ( 1183645 ) on Saturday May 31, 2008 @06:25AM (#23608433)
    Events like this seem to have become a near-monthly event. I would've thought banks and credit card companies and thier ilk would have learned thier lesson the first time something like this made news and started at least encrypting this stuff. Or at least the second time it happened. Or the third, maybe if we're cutting them a lot of slack. Yes, it's expensive and yes it's hard work, but it'd be less expensive than a potential 4.5 millian lawsuits and less work than the PR mess that they now have to clean up.
  • by Vectronic ( 1221470 ) on Saturday May 31, 2008 @06:38AM (#23608483)
    http://en.wikipedia.org/wiki/Bank_run [wikipedia.org]

    or skip to:
    http://en.wikipedia.org/wiki/Bank_run#History [wikipedia.org]

    If 4.5 million people is only a fraction of the data the bank had (assuming all data they have is equal to the amount of people they cater to) then if say 20,000,000 people withdrew their money, they'd be fucked, even if they only withdrew $200

    Especially considering the decline of the USD, granted, it probably wouldnt lead to a major event like the 'Great Depression' (although its possible) but it would kill that branch, break some bird eggs, make an omelet, etc.

    If the "Government" bailed them out (which would technically be the bank giving the government money to bail the bank out) the USD would plummet even further to probably mere tens of pennies.
  • by Hankapobe ( 1290722 ) on Saturday May 31, 2008 @06:47AM (#23608495)
    I'm aware of bank runs and what they did in the past in the US. Those days are gone. It would have no effect - even on that particular branch. The Bank of New York is a monster mega bank. It has over 100 Billion dollars in assets. This isn't some local yocal bank that Jimmy Stewart runs. And even then, with FDIC insurance, and the current rules for cash reserves, it won't happen. Regulations have been placed here in the US to prevent such a thing happening.
  • Re:really? again? (Score:3, Interesting)

    by Flamora ( 877499 ) on Saturday May 31, 2008 @06:47AM (#23608497)
    Yes, but you see, the encryption means that the bank itself has to do the work. In the case of lawsuits and PR issues, they have PR people and lawyers to deal with that, so the bank doesn't do much more work than lifting a finger and saying "go, mortal, and do thy job" or something.
  • by Yvanhoe ( 564877 ) on Saturday May 31, 2008 @07:04AM (#23608539) Journal
    There is a very good possibility that these data were stolen, not "lost". What is the black-market value of 4.5 million IDs ?
  • by barzok ( 26681 ) on Saturday May 31, 2008 @07:37AM (#23608637)
    I got a letter on Thursday informing me of the breach. It gave this URL: http://www.bnymellon.com/tapequery/ [bnymellon.com]

    This page has changed since Thursday. Originally it was only one incident, now it's two. The letter said that I'd get 1 year of credit monitoring at all 3 bureaus, free; when I signed up, I was given (and the page above) two years. The letter said there was no indication that the information had been used, but it also didn't mention what the summary here says - that SSNs and birthdates were on those tapes (I assumed they were).

    What really pisses me off isn't that it happened - it's that it took them three fucking months to inform me.

    I have 2 accounts with them (for the same employer, which is really stupid). One account requires my SSN, the stock ticker, and a 6-digit PIN. Digits only. Not terribly secure - there's only 10^6 possible PINs, my SSN may be in someone's hands, and there are only a couple thousand stock tickers. The other is a seemingly random ID and a 6-31 digit PIN. My previous PIN was 12 characters. The new one is 31.

    I reset both my PINs Thursday night, which took about half an hour - the sites, while not normally speed demons, were obscenely slow that night. I'm hoping it's because people were changing their PINs.
  • Re:really? again? (Score:2, Interesting)

    by knight0wl ( 1183645 ) on Saturday May 31, 2008 @07:42AM (#23608657)
    Yep, you're right. I honestly don't know why they haven't (or at least a class-action suit or something similiar). I'd love it if one of those "IAAL" types could fill me (and others) in on that.
    My point was simply that it would seem prudent to plan for worst-case senerios. I would think that profit-seeking entities would someday learn how profitable risk management can be, in the long run.

    Yes, I'm also aware "the long run" doesn't seem to be in our current corporate culture's lexicon. Hmm... it's possible I just answered one of my own questions.
  • by AaronLawrence ( 600990 ) * on Saturday May 31, 2008 @08:14AM (#23608763)
    Damages for possibly identity theft and access to your bank account? Hm ... lets pick a figure out of the air of (say) the value of any actual losses plus compensation of (say) $5000 ... triple that as punitive ... so all they have to do is pay up 15 billion dollars and they can continue! No problem.
  • by Chapter80 ( 926879 ) on Saturday May 31, 2008 @09:47AM (#23609185)

    the USD would plummet even further to probably mere tens of pennies.
    Isn't that true now? The USD is worth ten tens of pennies.

    :-) Just thought that wording was interesting!

The nation that controls magnetism controls the universe. -- Chester Gould/Dick Tracy

Working...