Monday, March 10, 2014
PORTLAND — As many as 267,000 TD Bank customers from Maine to California were affected by the loss of two data backup tapes that contained personal information such as Social Security numbers and driver’s license numbers.
In Maine, 34,907 residents were affected, according to a letter the bank sent to the attorney general.
The unencrypted tapes were lost more than six months ago, but TD Bank did not alert attorneys general in affected states until this week. The loss of data affects bank customers in at least six states, and may include names, addresses, dates of birth and account numbers.
“Is six to seven months as expeditious as possible? There may be a valid reason, but it does seem long on the face of it,” said Dan Mitchell, an attorney with Bernstein Shur in Portland and a member of the data security practice for the law firm, which is not involved in the data loss. “It’s not a common thing to lose that much information for that many customers.”
Under Maine law, companies must disclose information about data breaches or losses “as expediently as possible and without unreasonable delay,” but no formal timetable dictates how or when companies must notify customers.
A TD Bank spokeswoman said earlier this week that the bank wanted to conduct a thorough investigation before informing customers.
“We are not currently aware of any misuse of the personal information, but we are informing you of this incident because we are unable to locate the tapes or account for their disappearance,” TD Bank said in the letter to Maine’s attorney general.
TD Bank has offered to transfer customers to new accounts at the bank and to provide credit monitoring services for a year.
According to the Identity Theft Resource Center, which tracks data breaches and lost information, there have been 11 breaches of data by U.S. financial institutions so far this year, exposing more than 209,000 financial records. That number does not include those affected by the tape loss announced by the bank this week.
Mitchell said the physical loss of data – such as backup data tapes – is rare. More often, data gets lost electronically or is infiltrated by an outside hacker, he said.
TD Bank said the lost tapes were shipped to one of its locations in late March. The company did not elaborate on how the tapes were lost.
“If I was a customer, I would want to have more information in general and more information about what was specifically lost. What data was lost by each customer could have an impact on their reaction,” Mitchell said.
News of the lost data surfaced earlier this week as the bank began sending letters notifying customers and regulators. TD Bank initially declined to disclose to the media how many customers were affected.
On Friday, the company said the total was 260,000 customers. Massachusetts Attorney General Martha Coakley said in a statement that TD Bank told the state that notices were being sent to more than 267,000 potentially affected consumers.
“The loss of these tapes potentially puts the personal information of thousands of Massachusetts consumers at risk, and we remind consumers to take appropriate steps to protect themselves,” Coakley said. “We will be reviewing the circumstances of this breach and the steps that TD Bank is taking to address the loss.”
The loss affects a fraction of TD Bank’s more than 7.4 million customers in its more than 1,275 U.S. locations. TD Bank has 54 locations in Maine.
In Massachusetts, more than 73,000 residents were affected, while 35,000 customers were affected in Connecticut. Rhode Island had 500 residents and Maryland had 398 residents affected, according to attorneys general for those states. TD Bank said some customers in California were also affected.
The New Hamphshire attorney general said it had not received any notification from the bank. New Hampshire state law does not require a bank to disclose a loss of data or breach in security if it is overseen by federal regulators. TD Bank is overseen by the Office of the Comptroller of the Currency.
TD Bank is a unit of Toronto-Dominion Bank in Canada. It operates in 15 states on the East Coast and also has operations in the District of Columbia.
Staff Writer Jessica Hall can be contacted at 791-6316 or at: