Citigroup: UPS Lost Data on 3.9M Customers

Citigroup Inc. (C) Monday said computer tapes containing account and payment history data, including Social Security numbers, on 3.9 million customers were lost by United Parcel Service Inc. (UPS).

The disappearance is the latest in a series of reported data breaches involving U.S. companies, including Bank of America Corp. (BAC) and Time Warner Inc (TWX).

New York-based Citigroup said UPS, the world's biggest package carrier, lost the tapes while shipping them to an Experian credit bureau in Texas.

The tapes cp's North America consumer finance unit, in an interview. "You can imagine how frustrated and disappointed we are that this occurred."

Norman Black, a spokesman for Atlanta-based UPS, said "we sincerely regret that in this case we have not been able to find this package. We did conduct an exhaustive search."

Black said UPS is cooperating with Citigroup, and will "do everything we can to make sure this doesn't happen again."

In February, Bank of America said computer tapes containing data for some 1.2 million U.S. government employees, including U.S. senators, disappeared.

Time Warner, the world's biggest media company, in May said outside storage company Iron Mountain Inc. lost computer backup tapes containing data on 600,000 current and former employees.

New Jersey authorities said they made several arrests this year over a scheme to steal records of hundreds of thousands of customers at Bank of America, Wachovia Corp. (WB), PNC Financial Services Group Inc. (PNC) and Commerce Bancorp Inc. (CBH).

Other companies to suffer recent data breaches include ChoicePoint Inc. (CPS) and Reed Elsevier Plc's (search) LexisNexis (search) unit.

Citigroup said its missing tapes were shipped from Weehawken, New Jersey, on May 2. It said it first learned of a possible problem on May 20 when Experian called to request a tracking number.

The bank said Experian and UPS advised it on May 24 that they could not locate the tapes. Citigroup said it notified the U.S. Secret Service on May 27 after an internal investigation. That agency did not immediately return a call seeking comment.

Asked if Citigroup plans to keep using UPS, Debby Hopkins, Citigroup's chief operations and technology officer, in an interview said "we are evaluating that, and any remaining shipments we have with any of our couriers."

Nick Akerman, a partner at Dorsey & Whitney LLP who represents companies whose data are lost, said: "If you're Citigroup, you'd want to ask if UPS is the proper way to deliver such information, and whether you should be using private deliverers to transport sensitive data."

Akerman does not represent Citigroup, but said some of his account data at the bank might have been lost.

CitiFinancial is inviting customers to enroll via a toll-free number, 1-888-469-8603, in a free credit monitoring service for 90 days. It said it earlier enrolled the customers in a separate service to help prevent identity theft.