Bank of NY Mellon says data breach now affects 12M

When the breach was first disclosed in May, the bank estimated about 4.2 million people were affected, said Kevin Heine, a spokesman for the New York-based company. But a third-party re-examination of the analysis applied to the lost tapes has revealed that the affected number of individuals is actually about 12 million, Heine said. The company is in the process of notifying the additional consumers.

There has been no indication that the data lost on the tapes--which includes names, addresses, dates of birth and Social Security numbers--has been misused in any way, the bank said.

Bank of New York Mellon is offering all affected individuals fraud protection services, including two years of free credit monitoring through Experian and $25,000 of identity theft insurance through Virginia Surety Co. with no deductible.

A preliminary investigation by Connecticut's attorney general in May indicated that the computer tapes that disappeared in February included data from the Bank of New York Mellon and People's United Bank of Bridgeport.

Several customers of Peoples United Bank subsequently filed a lawsuit against both Peoples and the Bank of New York Mellon over the loss of the tapes.

"It is simply outrageous that this mountain of information was not better protected," Connecticut Governor M. Jodi Rell said in a statement Thursday. "We fear a substantial number of Connecticut residents are among this latest group."

Since May, the bank said it has instituted new stringent standards for the transport of confidential data and is initiating a companywide training program on data security for all employees.

"We are actively engaged in a top-to-bottom review of our security policies and procedures--including retaining a leading independent consultant to conduct an objective analysis of our current practices--and we are taking the steps necessary to ensure we have industry-leading security measures in place across all of our businesses," said Brian Rogan, the bank's chief risk officer, in a statement.