Wells Fargo Bank is notifying 7,000 individuals that a thief may have accessed their social security numbers, and other personal information, by illegally using the financial services firm's access codes.
The bank learned of the compromise on 1 July when MicroBilt, a reseller of consumer data, notified it of suspicious transactions made using the Wells Fargo access codes, a spokeswoman for the bank said. The codes are used by Wells Fargo employees to gain access to consumer credit data.
She said the records belonged to "random individuals," only a small number of whom are Wells Fargo customers.
"There is a full investigation underway to find out who is behind this," the spokeswoman said. Investigators have not yet determined how the Wells Fargo access credentials were illegally obtained or by whom, she added.
The compromise was first reported by The Breach Blog, which posted a link to a letter sent by Wells Fargo on 31 July to New Hampshire Attorney General Kelly Ayotte notifying her that nine state residents were affected by the breach.
In the letter, Peter McCorkell, Wells Fargo's senior company counsel, said that the investigation has confirmed that "a significant number of unauthorised transactions had been made using Wells Fargo's codes". He said that Social Security numbers, birth dates, addresses, driver's licence numbers and in some cases, credit account information, were illegally accessed.
McCorkell told Ayotte that the bank lacks contact information for all but about 2,400 of the affected individuals. The bank is in the process of finding addresses for the others, it added.
In a letter sent to the victims whose addresses were available, Sherry Courtney a senior vice president at the bank, disclosed the compromise and offered them a year's subscription to credit monitoring services. A copy of the letter was also sent to Ayotte.
The latest incident continues a string of embarrassing data compromises at Wells Fargo over the past few years almost all of them involving lost or stolen computers.
In Sept 2006, the company notified an undisclosed number of employees that personal data was stored on a computer and hard disc stolen from a locked car belonging to an employee of a third-party auditing firm.
Just four months earlier, Wells Fargo ha d disclosed that another lost computer contained personal data on an undisclosed number of mortgage customers and prospective clients. The system was reported lost in transit by a third-party firm that was transporting it from one Wells Fargo facility to another.
In February 2004, a laptop containing confidential information on more than 35,000 Wells Fargo customers was stolen from an employee's car parked at a gas station.