On February 27, 2009, BNY Mellon was transferring a load of computer tapes containing information including names, addresses, dates of birth and Social Security numbers, when it lost a tape carrying data on about 4.5 million people. Under Connecticut state law, banks are required to immediately notify customers when such information is lost, but according to a release from the Governor's Office, BNY Mellon did not notify People's of the true extent of the breach until mid-May, some eight weeks later.
BNY Mellon has not confirmed that other banks were involved, but media reports have indicated Webster and Wachovia customers may have been affected.
"I am gravely concerned by the unacceptable delay between the loss of this information and the notification to the affected consumers," Rell said. "The possibility that customers of additional banks are affected only adds to the problem. The data that has been compromised is, unfortunately, exactly the information identity thieves need most. We will be aggressive in determining the scope of this problem and making sure affected customers are notified in a timely fashion."
The DCP subpoenas seek details about the extent of the data breach, the timeline and conditions surrounding the tape loss, copies of any law enforcement or security reports filed following the loss, the names and addresses of all Connecticut customers whose names were included in any of the missing files and other pertinent facts.
