Topic: HSBC loses disc with 370,000 details

[Amker]

Another banking giant has lost confidential customer details, in an incident that mirrors the HM Revenue and Customs data loss of 2007.



HSBC has admitted losing a computer disc containing the details of nearly 400,000 customers.

The disc went missing, the bank confirmed, after being sent via a courier from a HSBC office in Southampton to the reinsurer Swiss Re at the beginning of February. It is not clear at what stage in the journey the disc went missing.

Such information is normally sent between companies using a secure data connection, but due to an equipment failure this was not possible on the day so the data was placed on a disc for posting. HSBC said the reinsurer is carrying out a thorough search of its facilities for the disc.

The loss mirrors the data loss experience by HM Revenue and Customs, when CDs containing personal and banking data for 25 million people was lost in transit.

"The disc contains the names, dates of birth and insurance cover levels of 370,000 people who hold life assurance policies at the bank. It does not contain addresses or bank account details," HSBC said in a statement.

"The data, which was password-protected, includes names, life insurance cover levels, dates of birth and whether or not a customer smokes. There is nothing else that could in any way compromise a customer and there is no reason to suppose that the disc has fallen into the wrong hands."

The bank added that customers who are affected by the data loss will be contacted and that a thorough investigation into the incident is underway.

The bank has informed the City watchdog, the Financial Services Authority (FSA), which may carry out an investigation. If it finds HSBC guilty of lax security, it could face a fine.

Nobody from the FSA was immediately available for comment. Norwich Union Life, one of the UK's largest life insurers, was fined Ł1.26 million by the FSA last December for exposing its customers to the risk of fraud.

Weaknesses in its systems and controls allowed fraudsters to impersonate customers and obtain sensitive details from its call centres. In some cases, they changed addresses and bank account details, helping them to then cash in policies totalling Ł3.3 million last year.

"With new cases of identity fraud splashed across the media on a daily basis, security should be everybody's top priority," said Ian Jackson, managing director of IT security specialists Imerja.

"This loss of data yet again demonstrates how organisations are failing in their responsibility to protect sensitive and confidential information that is in their possession and it highlights the unnecessary risks that companies are taking every day by handling information outside of secure IT systems."

"Information such as that lost by HSBC could be used as part of the jigsaw required to clone an individual's identity. It really is very concerning that cases like these are still coming to light."

"Organisations, whether large or small need to understand the responsibility and the potential damage that could be caused through their negligence and the obligation they are under when handling client information."

source:ITpro