The Register® — Biting the hand that feeds IT

HSBC pops thousands of customer details in the post

Guess what happened next?

Tune into our application security webcast, click here

HSBC has admitted that it has misplaced 370,000 customer details, which were put in the post a month ago on an unencrypted disc.

The envelope has not arrived at its intended destination - a reinsurance firm.

A spokesman for HSBC told the Reg: "We have sent a disc to our reinsurers which they never received. The disc was not encrypted but was password-protected. Our normal method is to use electronic transfer but on the day this happened the system was down so it was sent by disc instead." The disc was sent using ordinary Royal Mail services.

Nick Lowe, regional director for Northern Europe at security firm Check Point said: “The disc was apparently password-protected, but this can be overcome fairly easily by an IT-literate person.

“In this sector, where information is highly sensitive, always-on strong encryption of data is the minimum protection that should be applied to laptops, discs and USB storage devices."

The customer files did not contain account information or addresses but life insurance details, dates of birth and smoking habits.

HSBC has told the Financial Services Authority what happened. The FSA fined Nationwide £980,000 for breaching customer privacy last year by losing a laptop containing customer information. ®

See what The Register's experts have to say on application security

Don’t Miss

Win a Samsung C6625!

Reg Lucky Draw Windows Mobile handsets up for grabs

Palm_Pre_001_SMIs your cameraphone an oxymoron?

Pic Review iPhone 3G v iPhone 3GS v Palm Pre

Reg black vulture logoReg Mobile and Wireless newsletter is go! go! go!

Site news Email-tasm

Sign up, sign up for The Register IT security newsletter

Narrowcasting for the email classes