making
headlines

Blumenthal Seeks Tri-State Probe of Bank Breach

The state has broadened its investigation into the loss of a computer backup tape that reportedly contained personal and financial information about an undetermined number of Connecticut bank depositors, including 556,000 customers of People's United Bank.

Attorney General Richard Blumenthal said Friday that he has contacted attorneys general in New York and New Jersey, asking them to initiate a tri-state investigation into the security breach.

"There are ties to those states, and possible others," Blumenthal said.

Also on Friday, Gov. M. Jodi Rell directed the state Department of Consumer Protection to issue subpoenas to Wachovia Corp. and Webster Bank seeking more information about the missing tape. The new subpoenas were issued after Blumenthal said Thursday that the tape might also contain information related to those two banks.

However, The Bank of New York Mellon, which was responsible for the missing tape, told Blumenthal and Webster that no Webster customers were involved in the breach, Blumenthal and a Webster spokesman said Friday night.

The consumer protection department issued subpoenas earlier this week to The Bank of New York Mellon and People's United Bank of Bridgeport. The unencrypted tape was being transported by Archive Systems Inc., a New Jersey-based records storage company, on behalf of The Bank of New York Mellon when it was lost or stolen in late February.

Several customers of Peoples United Bank filed suit Friday over the data breach. The lawsuit, which seeks class-action status, was filed Friday in Superior Court in New Haven against both Peoples and The Bank of New York Mellon.

Mike Stratton, the attorney representing those suing the banks, said his clients are seeking extended credit monitoring, credit insurance and punitive damages. "Identity thieves are pretty patient and will wait years to use someone's information," Stratton said. "The aftershocks could go out a long way here."

The tape reportedly contains information, including names, addresses, dates of birth and Social Security numbers, for 4.5 million people nationwide, Blumenthal said.

The Bank of New York Mellon has not confirmed that any financial institution other than People's was involved, state officials said.
Webster Bank on Friday said that its name should not have been issued as a possible victim of lost information.

"No Webster customer, no Webster shareholder is in any way at risk because these tapes were lost," said Art House, Webster senior vice president for public affairs. "On something this important, I would hope the attorney general would confirm its accuracy before causing unnecessary anxiety among Webster customers. The attorney general has apologized, and I appreciate that."

Blumenthal said his office relied on "sources that were regarded as credible" who said Webster was involved. He said Mellon has yet to say in writing which banks' information was lost.

The Bank of New York Mellon reiterated Friday that because of the banking industry's confidentiality practices, it could not publicly divulge information about its client relationships. "We're engaged with and cooperating fully with the [Consumer Protection] commissioner's office, and also with the office of Connecticut's attorney general," said Ron Sommer, a Bank of New York Mellon spokesman. "At this point, we can't comment on specifics of those interactions."

Officials at Wachovia said Friday that they have not been told by Bank of New York Mellon that any of its customers are at risk. However, the bank was told by New York Mellon that some information about its employees "may be affected," spokeswoman Christy Phillips-Brown said. "Those employees were notified of the situation on May 20," Phillips-Brown said. "It's a small percentage of the 120,000 people that Wachovia employs."

Blumenthal said that all financial institutions involved are cooperating with the state's investigation. State officials have criticized The Bank of New York Mellon for failing to promptly notify affected financial institutions or customers of the security breach, as required by state law.

Rell said Bank of New York Mellon let more than eight weeks go by before it told People's United Bank or its customers the true extent of the security lapse, which could put millions of people at risk for identity theft and credit card and bank fraud.

Rell said New York Mellon first notified People's of the breach March 18, saying that information for about 170 shareholders was missing. It was not until May 13 that Bank of New York Mellon advised People's that information for 556,000 depositors was missing.

New York Mellon was in possession of the People's United Bank data because it was assisting the Connecticut bank with its second-step conversion in 2007, when it converted to a fully public company. People's was required to allow all of its depositors the opportunity to vote on the conversion. New York Mellon tabulated depositor votes and processed stock order requests.

"To do that, they needed information concerning our customers' bank accounts," People's officials said. "People's United transmitted encrypted information to The Bank of New York Mellon, which then created the unencrypted backup tape that was lost."

People's said Thursday that because it does not have information about the data that were lost and because Bank of New York Mellon was responsible for the security breach, it will rely on Mellon to contact its customers. New York Mellon is offering one year of free credit monitoring and is monitoring account activity.

Blumenthal, however, has demanded that New York Mellon provide those affected with two years of free credit monitoring, $25,000 worth of identify theft insurance and free credit freezes. Consumers seeking information about the breach should call a toll-free number set up by The Bank of New York Mellon at 877-278-3451.