370,000 bank records lost on way to Folkestone

[TrueBlueTerrier]

http://www.localrags.co.uk/index.php?na ... e&sid=4882

HSBC admitted today (7 April) that a computer disk containing 370,000 customers’ details went missing weeks ago, while on its way to Folkestone.

A computer disc containing the name, date of birth and health information on 370,000 people went missing after January 31, when staff at HSBC's Southampton office used Royal Mail to post the disc to the Folkestone office of Swiss Re, the reinsurer, because the usual electronic transfer system had broken down.

HSBC, whose website includes a section telling customers how to keep their online data safe, is now likely to face a big rap on the knuckles from the FSA, which has already fined Norwich Union (£1.26m) and Nationwide (£980,000) for not protecting its customers' data properly. Its case won’t be helped by the fact that although the data was password-protected, it wasn’t encrypted, as required by the Information Commissioner’s guidelines.

The bank was playing down the impact of the loss, saying that the disc ‘contains no address or bank account details for any customer and would therefore be of very limited, if any, use to criminals’.

This was presumably meant to be reassuring, although customers whose details are about to prove ‘a bit’ or even ‘slightly’ useful to hi-tech fraudsters may beg to differ. However, as HSBC was also quick to point out, ‘there is no reason to suppose that the disc has fallen into the wrong hands.’

[andy2007]

Are they sure this time that we handled the disk?
The last time someone reported this type of thing, it turned out that it wasn't sent via Royal Mail after all!

[Stormproof]

I bank with HSBC all my statements etc come via UKMail, so why have'nt they been mentioned in the article?

[andy2007]

I bank with HSBC all my statements etc come via UKMail, so why have'nt they been mentioned in the article?

I too bank with HSBC, and I also work in an RDC, so I know that we lost the contract with them some time ago.

Of course it is possible that they did use us for this particular item, as it was a single disk, rather than a bulk mailing. But quite frankly, I don't think that UKMail would have been too pleased if HSBC used the Competition (us)! It's certainly worth further investigation.

Even more importantly, why did it take so long for them to admit that the disk went missing. And why didn't they encrypt the data?
They already have robust encryption software, which they use in the ATM network. It would only take a few minutes to use it on the disk as well!

[Night Tonic]

It should NEVER have been sent by post but if it was entrusted to us, its not good. Still, I presume they DID send it special delivery - given the nature of the item?

[TrueBlueTerrier]

http://ukpress.google.com/article/ALeqM ... NnbBAzdilQ

21 hours ago

Banking giant HSBC has said a lost disc containing details of 370,000 customers was sent through the post.

The group said the disc was sent from its Southampton office to a reinsurer by Royal Mail, and not by external courier as was previously reported.

It also admitted that the details were not even sent by recorded delivery, explaining that a hard copy was sent because the electronic link it usually uses to transmit data to its reinsurer was down.

It emerged that the group had lost the disc, which was password protected but not encrypted, around four weeks ago. It contained the names, dates of birth and insurance cover levels of 370,000 people who have life assurance with the bank, generally linked to a mortgage.

The group said it was writing to customers whose details had been on the disc, but added that there were no address or bank details on it, so the possibility of anybody using the data to commit fraud was "quite limited".

An HSBC spokeswoman said: "The disc was sent by Royal Mail and not courier. It wasn't registered post and didn't need to be signed for, it was just normal mail.

"It was sent in error. We don't normally send hard copies of these details to reinsurance companies. It is normally done through an electronic link, which was down."

HSBC has informed the Financial Services Authority (FSA) about the breach and it is thought the group could be investigated and face a fine if the regulator finds that security was lax. The City watchdog has previously fined firms for not having proper systems in place to protect customers data.

It fined insurer Norwich Union £1.26 million in December for not having effective controls in place, enabling fraudsters to get hold of customers' details and cash in £3.3 million of policies. Nationwide was also fined £980,000 last year after a laptop which contained confidential customer details was stolen from an employee's home.

An FSA spokesman declined to comment on an individual case. A Royal Mail spokesman said: "If HSBC request it, we will of course help with any investigation."

[coaster]

Couldnt be bothered paying around four quid for Special Delivery which would have guaranteed delivery just about with track and trace.

My mind boggles, HSBC, one of the largest banks in the world, shy of paying less than a fiver (with change) for something this important.

Hope the gits get fined millions!

[sevenandseven]

As the thing was not sent Recorded or Registered who is to say it was even sent out. Or if it was sent who is to say it was not received and lost at the other office. Banks are capable of losing millions playing betting games on the stock market or giving mortgages to people who have no chance of paying them off so why should them losing a computer disc through their own incompetency be so surprising? Easier to blame the messenger.

[coaster]

As the thing was not sent Recorded or Registered who is to say it was even sent out. Or if it was sent who is to say it was not received and lost at the other office. Banks are capable of losing millions playing betting games on the stock market or giving mortgages to people who have no chance of paying them off so why should them losing a computer disc through their own incompetency be so surprising? Easier to blame the messenger.

Oh yes!