Bank customers' details sold on eBay computerInvestigation launched into ID blunder

27 August 2008

Man at computer

An investigation is underway into how a computer holding personal details of high street bank customers was sold on eBay for £35.

Information including bank account numbers, phone numbers, mothers' maiden names and signatures of one million customers of American Express, NatWest and the Royal Bank of Scotland were reportedly found on the computer.

The buyer, Andrew Chapman, an IT manager from Oxford, found the information on the computer's hard drive, the Independent newspaper reported.

Mail Source

It had belonged to data processing company Mail Source which is part of Graphic Data, a company that holds financial information for organisations, and was used at the firm's archive centre in Shoeburyness, Essex.

A Mail Source spokeswoman said the employee who sold the computer had made an 'honest mistake'.

She said the company was investigating, but stressed that the sale had been an 'isolated incident'.

Sold on eBay

She said: 'The computer was removed from our secure storage facility in Essex and sold on eBay.

'We know which employee took the server and sold it, but we believe it was an honest mistake and it was not intentional to sell it without the server being cleared.

'We want to stress that this is an isolated incident and we are investigating how the server was removed and sold. The security we have in place is what we are known for.

'This is a very unfortunate incident and we are taking measures to ensure it will never happen again.'

Data

Jenny Thomas, a spokeswoman for eBay, said that an item such as this should never have been sold on eBay and that the company is working with Graphic Data to investigate the sale.

An RBS spokeswoman said: 'Graphic Data has confirmed to us that one of their machines appears to have been inappropriately sold on via a third party.

'As a result, historical data relating to credit card applications from some of our customers and data from other banks were not removed.

'We take this issue extremely seriously and are working to resolve this regrettable loss with Graphic Data as a matter of urgency.'

Information Commissioner

A spokeswoman for the Information Commissioner's Office said yesterday that Mr Chapman had not yet handed the computer over to them but as soon as he did an investigation would be launched.

Mr Chapman said: 'I was appalled when I found the bank account information. That sort of thing shouldn't have been listed on there.'

He said it was not likely that 'any man on the street' would have bought the computer as it was listed on eBay as a server from a data centre, but a basic knowledge of computer software would have made locating the information quite simple.

'The information was in back-up CDs and in ISO files so it would have been possibly quite easy to find if you know something about computers.

'It's lucky that I found it and not someone else.'

© The Press Association. All rights reserved