Citigroup, the world's largest bank, on Monday said account and payment history data on 3.9 million of its customers were lost in transit by United Parcel Service.
The disappearance is the latest in a series of data breaches involving U.S. banks, including No. 2 Bank of America.
New York-based Citigroup said the data were stored on computer tapes, and lost while UPS, the world's biggest package carrier, was shipping them to an Experian credit bureau in Texas.
The tapes, which also contained Social Security numbers, covered CitiFinancial Branch Network customers and about 50,000 customers with closed accounts from CitiFinancial Retail Services. Customers of CitiFinancial Auto and CitiFinancial Mortgage are unaffected.
Citigroup on Saturday mailed a letter to customers about the problem. It said it has received no reports of unauthorized activity, and said there is "little risk" of the accounts being compromised.
"We were moving this using an enhanced security procedure we specified and developed with (UPS)," said Kevin Kessinger, president of Citigroup's North America consumer finance unit, in an interview. "You can imagine how frustrated and disappointed we are that this occurred."
Norman Black, a spokesman for Atlanta-based UPS, said "we sincerely regret that in this case we have not been able to find this package. We did conduct an exhaustive search."
Black said the company is cooperating with Citigroup, and will "do everything we can to make sure this doesn't happen again."
In February, Bank of America said computer tapes containing data for some 1.2 million U.S. government employees, including some senators, disappeared.
New Jersey authorities are separately investigating and have made several arrests in what they call a scheme to steal records of hundreds of thousands of customers at Bank of America, Wachovia, PNC Financial Services Group and Commerce Bancorp.
Other companies to suffer recent data breaches include ChoicePoint and Reed Elsevier's LexisNexis unit.
Citigroup said its missing tapes were shipped from Weehawken, N.J., on May 2. It said it first learned of a possible problem on May 20 when Experian called to request a tracking number.
The bank said Experian and UPS advised it on May 24 that they could not locate the tapes. Citigroup said it notified the U.S. Secret Service on May 27 after an internal investigation. That agency did not immediately return a call seeking comment.
Asked if Citigroup plans to keep using UPS, Debby Hopkins, Citigroup's chief operations and technology officer, said: "We are evaluating that and any remaining shipments we have with any of our couriers."
Black said UPS usually does not directly notify customers of lost packages. "Normally, that's not the direction (the communication) would go, but that's a level of detail we're not going to discuss," he said.
CitiFinancial is inviting customers to enroll via a toll-free number, 1-888-469-8603, in a free credit monitoring service for 90 days. It said it earlier enrolled the customers in a separate service to help prevent identity theft. SOURCE