Commonwealth Bank Lost Millions Of Customers’ Data And Decided Not To Tell Them

If you’re with Commonwealth Bank, sorry dude — it turns out the bank actually lost its data on 12 million customers two years ago, and didn’t bother to tell you.

Buzzfeed broke the news of the bank’s big mistake last night, revealing that magnetic tapes containing the bank statements for millions of customers between 2004 and 2014 were lost back in 2016 by subcontractor Fuji Xerox. The bank searched for the tapes and let its regulator know they were gone, but it never told the customers whose data was lost.

That’s a big problem, because while the Commonwealth Bank says there were no pins or passwords on the tapes, they still contained a lot of data that could be potentially misused if it falls into the wrong hands. As Buzzfeed put it, for all we know the tapes “might have fallen off the back of a truck”. Who knows where they are now, and who might have seen them?

The Commonwealth Bank said in a statement that “we take the protection of customer data very seriously and incidents like this are not acceptable. We want to assure our customers that no action is required and we apologise for any concern the incident may cause.”

This is the likely to be the largest financial services privacy breach in Australia's history, and involves almost all of the Commonwealth Bank's customer holdings. If you're a CBA account holder, your data could have been caught up in this.

— Paul Farrell (@FarrellPF) May 2, 2018

That assurance may come too late to make customers feel much better, though. This is one of the biggest privacy breaches in recent memory, possibly in Australia’s history, and it comes just days after the banking regulator delivered a scathing report on the Commonwealth Bank, describing a “widespread sense of complacency”, “lack of accountability”, and a failure to learn from mistakes at the company.

If you want to see that failure to learn from mistakes in action, check out the bank executives telling the ABC this morning that actually, not telling customers was probably a “good decision”.

Given that this is Australia’s biggest bank, that’s really not encouraging.