The Commonwealth Bank has admitted losing customer records for almost 20 million accounts over 16 years after failing to track down tapes on which the information was stored.
The tapes held customer names, addresses, account numbers and transaction details for 19.3 million accounts from 2000 to early 2016, but did not contain passwords or PINS which could be used to enable account fraud, CBA said in a statement.
"Ongoing monitoring of accounts by CBA confirms customers do not need to take any action," the lender said on Thursday.
The bank ordered an independent investigation in 2016 which found the tapes had most likely been disposed of, however customers were never told.
Acting group head of retail banking services Angus Sullivan said the relevant regulators were notified when CBA couldn't confirm whether the two magnetic tapes used to record customer statements were destroyed or not.
"We undertook a thorough forensic investigation, providing further updates to our regulators after its completion," Mr Sullivan said.
"We concluded, given the results of the investigation, that we would not alert customers."
The incident was not cyber-related and there was no compromise to the bank's technology platforms, systems, services, apps or websites, Australia's biggest lender said on Thursday.
"We take the protection of customer data very seriously and incidents like this are not acceptable," Mr Sullivan said.
"I want to assure our customers that we have taken the steps necessary to protect their information and we apologise for any concern this incident may cause."
The Office of the Australian Information Commissioner (OAIC) was notified of the incident in 2016 but did not take any further action.
Mr Sullivan defended the bank's decision not to tell customers.
"When incidents like these are shared more broadly, they create risks in and of themselves," he said.
"When we look back now, the decision that was made at the time has probably been borne out to be a good decision in as much that the data hasn't turned into fraudulent activity."
Shadow treasurer Chris Bowen said people should have been told.
"The government and the information commissioner need to make full statements today on their knowledge and actions in 2016," he said.
"Had the government not stalled in introducing Labor's data breach notification laws that are now in place, the bank would have been required by law to notify affected customers."
Shadow treasurer Chris Bowen (AAP) Source: AAP
CBA's admission has, however, sparked renewed interest from the commissioner, who is now is seeking new assurances from the lender that it has learned its lesson on data security.
The latest revelations cap a troublesome couple of weeks for CBA.
Earlier this week, its board was castigated by the Australian Prudential Regulation Authority for being complacent, dismissive of regulators, and lacking"zeal" in providing oversight, following an embarrassing money laundering scandal.
And last month, it was taken to task by the financial services royal commission after its wealth management arm charged thousands of customers, including people who had died, fees for no service.
Despite Thursday's revelations, CBA shares were up 23 cents, or 0.3 per cent, to $73.69 at 1037 AEST.
Share
