Commonwealth Bank says staff unwittingly sent more than 650 internal emails containing information relating to 10,000 customers to the wrong addresses.
The lender said 651 emails were sent by staff to addresses using the cba.com domain, which belonged to a US-based financial services firm and then a US cyber security company before it was acquired by CommBank in April 2017.
Commonwealth Bank, which last month admitted it lost historical records for almost 20 million accounts between 2000 and 2016, says no customer data was compromised as a result of the misdirected emails but that customers want to know about data security and privacy issues.
The emails and any associated data had not been used and were permanently deleted.
CommBank says it has begun contacting customers whose information was included in the emails.
Last month, the lender tried to reassure nervous customers after it admitted losing records when it failed to track down tapes on which the information was stored.
The bank ordered an independent investigation in 2016, which found the tapes had most likely been disposed of but that customers had not been told.
CBA said its technology platforms, services, apps or websites, had not been compromised by the mistake.
The latest revelations cap a troublesome couple of months for CBA, which has been slammed by the Australian Prudential Regulation Authority for being complacent, dismissive of regulators, and blind to threats such as the money-laundering scandal that ended the tenure of its chief executive.
CommBank shares were down 0.8 percent to $68.75 by 1505 AEST on Friday.
