Bank data disc 'lost in post'

8 April 2008 12:00am

Banking giant HSBC has said a lost disc containing details of 370,000 customers was sent through the post.

The group said the disc was sent from its Southampton office to a reinsurer by Royal Mail, and not by external courier as was previously reported.

It also admitted that the details were not even sent by recorded delivery, explaining that a hard copy was sent because the electronic link it usually uses to transmit data to its reinsurer was down.

It emerged that the group had lost the disc, which was password protected but not encrypted, around four weeks ago. It contained the names, dates of birth and insurance cover levels of 370,000 people who have life assurance with the bank, generally linked to a mortgage.

The group said it was writing to customers whose details had been on the disc, but added that there were no address or bank details on it, so the possibility of anybody using the data to commit fraud was "quite limited".

An HSBC spokeswoman said: "The disc was sent by Royal Mail and not courier. It wasn't registered post and didn't need to be signed for, it was just normal mail.

"It was sent in error. We don't normally send hard copies of these details to reinsurance companies. It is normally done through an electronic link, which was down."

HSBC has informed the Financial Services Authority (FSA) about the breach and it is thought the group could be investigated and face a fine if the regulator finds that security was lax. The City watchdog has previously fined firms for not having proper systems in place to protect customers data.

It fined insurer Norwich Union £1.26 million in December for not having effective controls in place, enabling fraudsters to get hold of customers' details and cash in £3.3 million of policies. Nationwide was also fined £980,000 last year after a laptop which contained confidential customer details was stolen from an employee's home.

An FSA spokesman declined to comment on an individual case. A Royal Mail spokesman said: "If HSBC request it, we will of course help with any investigation."

© The Press Association