CBA in damage control on tapes

Fears for account data

THE Commonwealth Bank is trying to reassure nervous customers after it admitted losing records for almost 20 million accounts when it failed to track down tapes on which the information was stored.

The tapes held customers’ names, addresses, account numbers and transaction details for 19.3 million accounts from 2000 to early 2016, but did not contain passwords or PINS that could be used to enable account fraud, CBA said in a statement.

“Ongoing monitoring of accounts by CBA confirms customers do not need to take any action,” the lender said.

The bank ordered an independent investigation in 2016 that found the tapes had most likely been disposed of, but customers were never told.

Prime Minister Malcolm Turnbull described the incident as an “extraordinary blunder” and said customers should have been informed.

“It’s hard to imagine how so much data could be lost this way,” Mr Turnbull said.

“Maintaining data security is of vital importance for everybody ... and if there is a serious data breach or loss, the people affected should be advised so they can take steps to protect themselves.”

Mr Turnbull said, if the incident had occurred today, the bank would have been required, under new laws introduced at the start of the year, to publicly advise each customer about the loss of data.

Acting group head of retail banking services Angus Sullivan said the relevant regulators were notified when CBA couldn’t confirm whether the two magnetic tapes used to record customer statements were destroyed or not.

“We undertook a thorough forensic investigation, providing further updates to our regulators after its completion,” Mr Sullivan said.

“We concluded, given the results of the investigation, that we would not alert customers.”

CBA yesterday reiterated to customers there was no compromise to the bank’s technology platforms, systems, services, apps or websites.

“I want to assure our customers that we have taken the steps necessary to protect their information and we apologise for any concern this incident may cause,” Mr Sullivan said.

The Office of the Australian Information Commissioner (OAIC) was notified of the incident in 2016 but did not take any further action.