Intelligent Enterprise

Bank of New York Mellon recently reported the loss of back-up tapes. True, the breach might jeopardize about 4.5 million people nationwide, but there's nothing to worry about... only about 500,000 persons are directly affected. Also, the backup tapes weren't encrypted, but there's no cause for concern — the tapes only had a few trivial details like names, bank account numbers, social security numbers, net worth and financial transaction histories. And yes, company officials did hide this breach from us for a full two months, but it's clear that they care: for the lifelong loss of their identity, customers will be offered two full years (no less!) of free credit monitoring, $25,000 worth of identity theft insurance (now you know what your identity is worth) and "credit freeze benefits" (why didn't someone tell me earlier that getting my credit frozen is actually a benefit?).

Not fully comforted yet? The "Chief Risk Officer" of BNY Mellon assures us that there is "no indication that the data on these tapes has been misused" (in other words, there's essentially nothing we can do but twiddle our thumbs and wait for bad news). And, of course, rest assured that the bank will be conducting a "thorough, top-to-bottom review of our existing security policies and procedures, particularly related to vendors and outside contractors used by the company" (in other words, it's not us — it's them).

Don't have an account with BNY Mellon? No need to feel left out — Connecticut Attorney General Richard Blumenthal expects that depositors and shareholders of at least 25 companies (including People's United Bank, Hancock Financial Services Inc., Walt Disney Co. and TD Bank Financial Group) are at risk of identity theft on account of this breach.

All those affected will be receiving a letter from BNY Mellon free of charge (wall-mount frame costs extra). Don't be surprised if you get a letter from the thieves too…after all, they do share the same customer database now. (For more of this entertainment, read, this article in the New Haven Register.)

Another data breach; more hand-wringing, some empty gestures and a few lawsuits: Who really cares, right? Let's hope that the tapes will be found in some dumpster or landfill; hey, no damage done — we can all go to bed happy.

Inured as we are to data breaches, the above incident is particularly egregious, not just for the loss of data (which is just plain a failure of defining a procedure or enforcing it), but especially for keeping it under wraps for months... even from affected customers. Unless there is some consistent, coordinated and stringent national level action, it won't be long before we begin to define the "average American household" as one that's been victimized for identity at least once.