Computer tapes with information about consumer lending lost by UPS in transit to credit bureau.
June 6, 2005: 2:46 PM EDT
NEW YORK (CNN/Money) - Citigroup said Monday that personal information on 3.9 million consumer lending customers was lost by UPS while in transit to a credit bureau -- the biggest breach of customer or employee data reported so far.
Citigroup did not immediately return a call to CNN seeking comment, but it sent its customers a letter saying the tapes included Social Security numbers, names, account history and loan information about retail customers, and former customers, in the United States.
The letter added that the company had no reason to believe the information has been used inappropriately and that it has received no reports of unauthorized activity.
"We deeply regret this incident, which occurred in spite of the enhanced security procedures we require of our couriers," Kevin Kessinger, executive vice president of Citigroup (Research), said in a statement. "Beginning in July, this data will be sent electronically in encrypted form," said Kessinger, who heads the company's consumer finance business in North America.
In its letter, Citigroup told the people affected there was "little risk of your account being compromised because you have already received your loan."
"No additional credit may be obtained from CitiFinancial without your prior approval, either by initiating a new application or by providing positive proof of identification," the nation's No. 1 financial services company said in the letter.
In recent months, a number of big banks, retailers and other companies have disclosed that information on customers or employees, including credit-card information, was compromised.
Bank of America (up $0.10 to $45.88, Research) said in late February that it lost computer backup tapes containing personal information on about 1.2 million charge cards.
Time Warner Inc., which owns CNN/Money, Time magazine, AOL and other companies, reported last month that information on 600,000 current and former employees was missing.
In its statement, New York-based Citigroup said the lost tapes contained information about retail customers in the United States as well as some customers with closed retail services accounts. Auto loan and mortgage customers were not affected, it said.
United Parcel Service (up $0.18 to $73.00, Research) confirmed it lost a package shipped by Citigroup containing computer tapes.
Norman Black, a spokesman for the world's largest package delivery company, said a "small package" containing data storage tapes was lost while being transferred to a credit reporting bureau.
Experian, a credit reporting agency, told CNN that it was the intended recipient of the tapes. Don Girard, a spokesman for Experian, said the company alerted Citigroup in the last week of May that its regularly scheduled delivery did not arrive. Girard said the tapes were headed for its Data Center in Allen, Texas.
Black at UPS said his company and Citigroup are launching internal investigations, adding there was no evidence of theft or fraudulent activity. UPS ships some 14 million packages a day.
CitiFinancial is inviting customers to enroll via a toll-free number, 1-888-469-8603, in a free credit monitoring service for 90 days. It said it earlier enrolled the customers in a separate service to help prevent identity theft.
