Chase discards tapes with data on 2.6M Circuit City customers

Computerworld - About 2.6 million current and former Circuit City credit card account holders are being notified by credit card vendor Chase Card Services that five computer data tapes containing their personal information were mistakenly identified as trash and thrown away by Chase personnel in July.

In a statement yesterday, Chase said that no misuse of the credit card information has been reported and that the tapes are believed to have been destroyed in processing.

"Working closely with federal and local law enforcement, Chase conducted a thorough investigation and believes that the tapes, contained within a locked box, were compacted, destroyed and are buried in a landfill where the trash was taken," the company said.

"We deeply regret that this has occurred and apologize to those impacted," said Rich Srednicki, CEO of Chase Card Services, which issues co-branded and private-label credit cards for Circuit City, in a statement. "We have found no evidence that the tapes or their contents have been accessed or misused. The privacy of our customers' personal information is of utmost importance to us, and we take the responsibility to safeguard this information very seriously."

To prevent similar incidents, Chase said it is strengthening its security procedures and is conducting a review of all data storage and protection processes.

Chase began notifying the affected customers about the incident yesterday and said the process is expected to take two to three weeks. The company is offering one year of free credit monitoring to people whose Social Security numbers were on the tapes.

"We take responsibility for this and are making every effort to let affected card members know what we are doing and what we suggest they do to protect themselves," Srednicki said. "We want our customers to have the support they need to monitor their credit and know how to respond should they identify any problems."

Paul Hartwick, senior vice president of business affairs for Wilmington, Del.-based Chase Card Services, said the tapes were accidentally thrown away due to "human error."

"We have strict procedures on how tapes are processed and handled," Hartwick said. "In this case, it came down to someone not following those specific procedures."

The company is now reviewing its training procedures with employees in response to the error, Hartwick said.

The tape disposal incident occurred in July and was discovered through a scheduled security systems audit, he said. Law enforcement authorities were then contacted, and the company replicated the data on the tapes that were thrown away to determine whether customer account information was on the tapes. Chase then began monitoring the affected accounts for suspicious activity, Hartwick said.

He said the company would not publicly comment about whether the data on the tapes was encrypted, nor would he reveal where the incident occurred.

Chase Card Services is a division of New York-based JPMorgan Chase & Co.

Read more about storage in Computerworld's Storage Knowledge Center.