Nearly 35,000 Mainers may have had their personal information — including Social Security and bank account numbers — compromised during TD Bank’s March security breach.
In a letter to the Maine attorney general’s office dated Oct. 5 and received Oct. 11, TD Bank’s chief privacy officer acknowledged that two computer data backup tapes went missing while they were being shipped to a TD Bank location. The letter said the tapes may have included not only names, addresses, Social Security numbers and bank account numbers, but also dates of birth and driver’s license numbers for 34,907 Mainers.
TD Bank’s notice to customers did not mention that dates of birth and driver’s license numbers may have been among the missing data. Both pieces of personal information can make identity theft easier.
The breach affects customers throughout TD Bank’s East Coast coverage area, from Florida to Maine. TD Bank spokeswoman Rebecca Acevedo has declined to say how many customers were affected overall, but the bank’s letter to the Maine attorney general’s office, which details the number of Maine customers affected, was obtained by the Sun Journal as a public document.
Although the breach occurred in March, TD Bank did not begin notifying customers until a couple of weeks ago. Acevedo said the bank held off as it conducted an internal investigation. That investigation is ongoing and the bank has contacted Massachusetts law enforcement, as well.
TD Bank officials say there was no indication the data had been misused.
Maine law requires companies to notify the state, as well as customers, of security breaches. TD Bank sent out notification letters Oct. 3 to affected Maine customers. Although letters continue to to be sent to customers in other states, all affected Maine customers should have been notified by now. Only affected customers got letters.
Some customers have complained that TD Bank should have told them sooner that their data was lost, putting them at risk of identity theft. It is unclear whether such a delay is allowed. Maine law permits businesses to conduct investigations before notifying customers of security breaches, but notifications must be made “as expediently as possible and without unreasonable delay.”
Officials with the consumer protection arm of the attorney general’s office were unavailable for comment Thursday. That office could help gauge whether TD Bank’s notification was made expediently and “without unreasonable delay.”
TD Bank has offered to transfer funds in affected accounts to new accounts and to provide affected adult customers with a year’s worth of free credit monitoring.
TD Bank has nearly 1,300 branches nationwide, including 54 in Maine.
Isn’t credit monitoring already free?
Yes, you are allowed one free report from all 3 credit monitoring services each year. The one year of free credit monitoring offered by TD Bank would allow them access anytime & for as many times as they want during that year.
Does anyone know if the year of free credit monitoring ends next March or next October?? The story doesn’t say, of course.
Another reason for not switching to TD bank.
I wonder when we find out who we might be?
Dump these dopes and switch to a local bank or credit union.
You know not from what you speak. Smaller instituitions are far more at risk to be comprimised from hacking. The TD breach was a misplacement of tapes or carelessness but from a standpoint of system hardening go with a larger bank.
Except that every time I read an article about customer information being accessed by hackers, it seems to involve a big bank.
bootlicker much?
The stories this week are the only notice I’ve had that something went wrong . TD, where is my letter?
It must be lost in the mail with mine. They didn’t notify me.
It would have made sense to close all the accounts right away and then notify the customers of the security breech and TD’s action to help stop the possible ID theft. My suspicious minds tells me there is more to the story than, of course, they are sharing. I would be livid with the delayed news of, 7 months, concerning my legal right to control my own account.
The high risk for the other clients could have been avoided as well. Shady…..
I closed our accounts over 6 years ago, but still got a letter, because apparently my information was still included on these tapes. I was really glad that I didn’t have an account with them anymore- 7 MONTHS later to be notified! No excuse is reasonable for that.
TD BANK… ARE YOU KIDDING ME??
This happened in March – why are we just now hearing about it?
Instead of calling the Maine AG as soon as it was known and enlisting their immediate assistance, you sent a LETTER 7 months later?
A letter which the Maine AG did not receive until today – a full week after it was sent?
At the VERY least, you should have kicked in the dough to over-night the letter to the AG.
Or hello, pick up the phone!
This is absolutely outrageous. A letter should have gone out to ALL customers in this demographic back in MARCH, so we could have taken steps back THEN to monitor our accounts, and to secure them for the next time your safety measures fail. This is the 3rd time in just FIVE years – two of which, I wasn’t even a TD customer – that the bank has had the same issue here in Maine. NOT including when my account was hacked and overdrawn by thousands of dollars of transactions occurring from California to Milan in less than 12 hours. The bank didn’t even contact me – I found and investigated the issue, and had to report it to the bank!)It’s a lot easier for an institution to deflect attention away from your mistakes when it can be combined with another established company’s name – like the Hannaford Bros. incident, or the TJ Maxx incident. Where is my assurance that you take full responsibility and will do everything necessary to rectify this? Rather, we were kept in the dark, the Maine AG was kept in the dark… This stinks to high Heaven, and the Maine AG should already be starting an investigation, with the Federal Reserve’s and the FDIC’s resources and cooperation. It is my opinion that a class-action suit against TD Bank be pursued immediately.
Does anyone know if the year of free credit monitoring ends next March or next October?? The story doesn’t say, of course.