HSBC loses customer data

Steve_xx

The HSBC banking group has admitted losing a computer disc with the details of 370,000 customers.
The disc was lost four weeks ago after being sent by courier from the bank's offices in Southampton.
The customers' details included their names, dates of birth, and their levels of life insurance cover. However, there are no addresses or bank account details and HSBC said the customers' exposure to potential fraud was limited.

Link: http://newsvote.bbc.co.uk/1/hi/business/7334249.stm

Lokolo

Steve_xx wrote: »

The HSBC banking group has admitted losing a computer disc with the details of 370,000 customers.
The disc was lost four weeks ago after being sent by courier from the bank's offices in Southampton.
The customers' details included their names, dates of birth, and their levels of life insurance cover. However, there are no addresses or bank account details and HSBC said the customers' exposure to potential fraud was limited.

Link: http://newsvote.bbc.co.uk/1/hi/business/7334249.stm

No worry then, don't have life insurance and I doubt you can do much with my name and DOB! Hm maybe sign me up to one of those dirty sites, nevermind :A

Aegis

Steve_xx wrote: »

The HSBC banking group has admitted losing a computer disc with the details of 370,000 customers.
The disc was lost four weeks ago after being sent by courier from the bank's offices in Southampton.
The customers' details included their names, dates of birth, and their levels of life insurance cover. However, there are no addresses or bank account details and HSBC said the customers' exposure to potential fraud was limited.

Link: http://newsvote.bbc.co.uk/1/hi/business/7334249.stm

Yeah, the lost data wasn't particularly sensitive compared to what it could have been, and the disk was at least password protected. Still a major !!!! up, and hopefully one that will see data-handling procedures changed throughout the bank.

Meltdown_2

Aegis wrote: »

Yeah, the lost data wasn't particularly sensitive compared to what it could have been, and the disk was at least password protected. Still a major !!!! up, and hopefully one that will see data-handling procedures changed throughout the bank.

1. Are we sure what was on the disk? Do we believe HSBC?
2. Why on earth was it password protected? Surely it should have been encrypted.
3. Why are they sending disks around the country? Why not use secure electronic transfer?
(After all, they regard that as secure enough for people's money.)

Edit: I wrote the above before reading the link given (I had heard about the data loss on the radio).
Since they accept that the disk should have been encrypted, why wasn't it? One has a nagging feeling that it might have been related to the quality of the staff involved.
They say the electronic link was down in February. Does it take so long to repair these links that sending a disk is quicker?

Aegis

Meltdown wrote: »

1. Are we sure what was on the disk? Do we believe HSBC?

I received that information in an internal memo, so I'm assuming it's correct.

2. Why on earth was it password protected? Surely it should have been encrypted.

It should have been, yes. I suspect that someone thought that as the data wasn't too sensitive, a password would do. I'd further suspect that this person doesn't know all that much about information security and should be sent on an ISO27001 course as soon as possible!

3. Why are they sending disks around the country? Why not use secure electronic transfer?
(After all, they regard that as secure enough for people's money.)

It's my understanding that normally the data is sent down a secure internet connection, but that during the week in question there was a problem. Evidently the data handlers figured that sending the data would be faster than waiting for the connection to come back online.

The people whose data has been lost will be contacted before too long to advise them of what has happened. I would assume until then that the situation is no worse than the press releases tell us. Of course, if it turns out that it's worse than that, then someone will probably be looking at the wrong end of a disciplinary hearing...


p.s. As I've already been accused of this by my mother, I'd like to officially deny any involvement in this issue! It wasn't me!!

Quokka_2

Hello,
I'm new to the forum and have read the exchanges on the lost data issue with interest.

I'm one of the people whose data was on the 'missing' disc. I only received notification of this in a letter dated 25 April. This is after the disc went missing on 31 Jan, HSBC management were informed on 20 March and I received my letter on 28 April. Obviously, the communication wheels at HSBC don't work very well if it takes nearly TWO months for management to be informed of the missing disc, and a further month for the customers to be told.

Any advice on this anyone, please? I'll be going in to my branch to speak with my Account Manager to see what they are doing despite there being "only" my name, DOB, gender etc on the disc. I've checked my bank account but nothing seems amiss, so far.