Governor Calls Bank Of NY Mellon Notification Delay ‘Outrageous’

HARTFORD — Governor M. Jodi Rell said the state’s investigation into the loss of confidential data of more than 500,000 Connecticut residents by the Bank of New York Mellon Corp has revealed the security breach is much broader than first reported. The news also roused the ire of Attorney General Richard Blumenthal.

Connecticut consumers were among four million people whose data was lost in February when BNY Mellon was transferring information, some on behalf of People’s United Bank of Bridgeport.

“It is simply outrageous that this mountain of information was not better protected and it is equally outrageous that we are hearing about a possible six million additional individuals and businesses six months after the fact,” Gov Rell said. “We fear a substantial number Connecticut residents are among this latest group.”

“The bank took nearly eight months to warn consumers, an unacceptable and inexcusable delay that left them highly vulnerable to the dangers of identity theft and financial turmoil,” Mr Blumenthal added. “Bank of New York Mellon has fumbled yet again, severely mishandling this serious information loss, a potential financial nightmare for consumers.”

The sensitive data includes names, addresses, dates of birth, and Social Security numbers. BNY Mellon did not notify People’s until May 13 that information on 556,000 People’s depositors was missing.

The most recent figures came in response to the subpoenas that Gov Rell had ordered be issued in May by the state Department of Consumer Protection. BNY Mellon informed the state that it has now begun the process of notifying these additional customers. Under Connecticut state law, banks are required to immediately notify customers when such information is lost.

“Had the hundreds of thousands of Connecticut residents affected been notified immediately that their data had been compromised, they could have taken steps to protect themselves,” the governor noted.

The governor has directed Consumer Protection Commissioner Jerry Farrell, Jr, to continue to work with Attorney General Blumenthal and pursue “all remedies available” under Connecticut law against BNY Mellon, including seeking a substantial fine, restitution to consumers, and other penalties.

“The bank has an obligation to cover financial losses consumers may have suffered because of its failure to swiftly inform,” Mr Blumenthal said. “We are prepared to take action if necessary to recover losses to consumers.”

BNY Mellon is currently providing free identity theft protection for the Connecticut residents initially affected.

The governor directed Commissioner Farrell to meet with BNY Mellon leadership and insist the bank extends the same identity protection to the additional Connecticut residents.

Commissioner Farrell said the DCP subpoenas sought details about the extent of the data breach, the timeline and conditions surrounding the tape loss, copies of any law enforcement or security reports filed following the loss, the names and addresses of all Connecticut customers whose names were included in any of the missing files and other pertinent facts.

“Nothing in the data we were given in May and June by BNY Mellon indicated in any way that these additional six million individuals and businesses were involved,” Mr Farrell said. “This certainly raises serious additional questions about how secure personal identifying data is at the Bank of New York Mellon and widens the scope of our investigation.”

The governor also called upon the federal government to tighten steps to prevent security breaches and enforce existing laws against violators.

“The vast dimensions of this data breach affect not only hundreds of thousands of individuals and businesses in Connecticut, but millions across our nation,” Gov Rell said.

The attorney general said he is appalled and outraged by Bank of New York Mellon’s months-long delay in informing millions more consumers that it lost their personal financial information.

“The bank’s inept approach to this massive data loss — potentially devastating for consumers — must cease,” Mr Blumenthal said.