US and Canadian data breaches cause concern

MONTREAL – The Canadian Imperial Bank of Commerce (CIBC) announced in mid-January that its mutual fund subsidiary, Talvest Mutual Funds, has lost a backup computer drive containing information on around 470,000 clients.

The loss – and the massive potential security breach it may have caused – is being investigated by Canada's privacy commissioner Jennifer Stoddart. It was also reported extensively in the Canadian media.

"My office is committed to carrying out a thorough investigation into this matter and to ensuring that preventive and corrective measures are put in place so that this does not reoccur," Stoddart said in a statement.

CIBC said there is no evidence to suggest the lost backup file has been "inappropriately accessed". However, the bank will be notifying all affected clients by letter, compensating them for monetary loss arising directly from unauthorised access of personal information contained on the file, and providing affected clients with the opportunity to enroll in a credit monitoring service at no cost.

The lost data comes at the same time as US retailer TJ Maxx announced that customer credit card data had been stolen from one of its computers in May 2006. The breach was discovered in December 2006, and it is believed that more than 200,000 customers are affected. US banking associations and politicians have waded into the discussion about how retailers should work with banks to keep customer data safe.