HSBC loses disk with policy details of 370,000 customers

HSBC loses disk with policy details of 370,000 customers

HSBC is facing the possibility of a regulatory inquiry and heavy fines after it was forced yesterday to confirm it had lost an unencrypted disk containing life insurance policy details for 370,000 customers.

Britain's biggest bank confirmed a newspaper report revealing the disk had disappeared in the post more than seven weeks ago. Customers have not been told their details have gone astray and questions have been raised about the speed and thoroughness of HSBC's investigation into the data loss.

HSBC said the disk contained names, dates of birth and policy numbers as well as the amount of cover taken out and smoking habits of policyholders. A spokesman stressed that no other information, such as personal bank account details or medical details, was on the disk. It was password-protected but not encrypted.

"There is nothing else that could in any way compromise a customer and there is no reason to suppose that the disk has fallen into the wrong hands," HSBC said in a statement. "Nonetheless, HSBC would like to apologise to its customers for any concern this may cause them. Each customer will be contacted shortly and a thorough investigation into this matter is under way." The bank is not recommending any action be taken by customers whose details have gone astray.

The disk went missing in February, three months after Paul Gray resigned as chairman of Revenue & Customs over the loss in the post of two child benefit information disks, which.....continued below

Advertisement starts

---

---

Advertisement ends

contained data on every child in Britain and the bank and national insurance details of their parents.

A spokesman for HSBC said an internal inquiry began as soon as the bank was told the disk had not arrived at its destination.

But Royal Mail said it had not been contacted about the lost disk. "If HSBC requests it, we will of course help with any investigation," a spokesman said.

The City regulator, the Financial Services Authority, was informed only last week, HSBC admitted.

The bank said the data loss had come about because of a "unique set of circumstances", blaming the failure of a secure encrypted digital link between HSBC's Southampton office and reinsurer Swiss Re in Folkestone, Kent. It said the information had been required urgently by Swiss Re and, when the secure link failed, it had been burned on to a disk and put in the Royal Mail's business post. No courier service was involved, HSBC said.

The FSA has signalled its determination to clamp down on firms not taking reasonable care of customer data. It has imposed heavy fines on companies failing to own up to breaches in data security.

Last December the FSA fined Norwich Union £1.26m for lax security which allowed fraudsters to target life insurance policyholders. The regulator criticised the insurer for failing to address deficiencies swiftly.

guardian.co.uk © Guardian Newspapers Limited 2008