Connecticut widens probe into BNY Mellon data breach

BOSTON (Reuters) - Connecticut authorities widened a probe on Friday into a security breach at Bank of New York Mellon Corp involving the loss of personal information including Social Security numbers on about 4.5 million customers.

Governor Jodi Rell said she had directed the state to issue two more subpoenas, one each to Webster Bank and Wachovia Corp. Bank of New York Mellon and People's United Bank of Bridgeport were issued subpoenas seeking evidence on Thursday.

"I am gravely concerned by the unacceptable delay between the loss of this information and the notification to the affected consumers," Rell said in a statement.

"The possibility that customers of additional banks are affected only adds to the problem," she said.

State officials say that on February 27, Bank of New York Mellon was transferring back-up tapes with data including names, addresses, birthdates and Social Security numbers when it lost a box with six to 10 unencrypted tapes containing the data.

The bank, one of the world's largest asset managers, has said that an archiving vendor lost the tapes containing information from its Shareowner Services unit and that there was no evidence that any data had been inappropriately accessed or used.

Connecticut Attorney General Richard Blumenthal said on Wednesday that customers of People's United Bank of Bridgeport and possibly other banks were affected, calling the loss of the storage tapes "highly dangerous" and "possibly devastating".

Rell said Connecticut state law required banks to immediately notify customers when such information was lost.

"BNY Mellon did not notify People's of the true extent of the breach until mid-May, some eight weeks later," she said.

"The data that has been compromised is, unfortunately, exactly the information identity thieves need most."

BNY Mellon is offering a year of free credit monitoring to those affected through a national service provider.

"When Shareowner Services' archiving vendor indicated that it was unable to account for the box, the company immediately undertook an investigation into the matter, alerted law enforcement, and began implementing new procedures to help prevent this from occurring in the future," BNY Mellon spokesman Ron Sommer said in an e-mailed statement.

Connecticut's subpoenas will be issued from its Consumer Protection Commissioner. They seek details about the extent of the data breach among other information.

(Reporting by Jason Szep; Editing by Ted Kerr)