Bank of New York Mellon breach gets bigger

It was reported in May that unencrypted back-up computer tapes from BNY Mellon's Shareowner Services unit containing the confidential details of over four million customers had been lost by a third party vendor.

But bank spokesman Kevin Heine has now told reporters that a forensic review of the analysis applied to the lost tapes has revealed that the number of customers affected by the breach is around 12 million.

In a statement the bank says it is in the process of notifying the additional customers. It says there is no indication that the data - which includes social security numbers, names, addresses and dates of birth - has been accessed or misused in any way. However the bank is offering affected customers fraud protection services, including free credit monitoring.

"We are actively engaged in a top-to-bottom review of our security policies and procedures - including retaining a leading independent consultant to conduct an objective analysis of our current practices - and we are taking the steps necessary to ensure we have industry-leading security measures in place across all of our businesses," says Brian Rogan, chief risk officer at Bank of New York Mellon.

The bank says since the incident it has overhauled security policies and procedures and confidential data is now transferred within the company in encrypted form in order to minimise the need for data storage tapes.

Details of the breach were released by the Connecticut Attorney General Richard Blumenthal in May. It was reported that a box containing between six and 10 unencrypted back-up tapes was lost in transit on 27 February.

The missing box was one of 10 that were being transported from Bank of New York Mellon's shareowner services division to a holding facility by storage firm Archive Systems. When the vehicle arrived at its destination one of the boxes was missing.