Here's what the (unencrypted) tapes contained, according to Attorney General Blumenthal's letter:
BNY representatives informed my office that the information on the tapes contained, at a minimum, Social Security numbers, names and addresses, and possibly bank account numbers and balances.
In the letter, available here, the attorney general asks the bank a series of 12 questions that aim to get to the bottom of this incident, as well as any other possible incidents.
I just have two questions: Why has it taken so long for the loss of this backup tape to become public? Why wasn't the tape encrypted?
Perhaps the tape is just misplaced. Perhaps it fell out of the truck and rolled down a sewer. Perhaps only nine tapes where placed on the truck in the first place. Or maybe, a bad guy busted the lock and grabbed a tape. The broken lock on the truck points to an uncomfortable likelihood that the tape was stolen, and all 4.5 million customers should have been notified right away.
Of course, all of this could have been avoided by scrambling the information on the tape. Of all the things companies can do to protect your information, encrypting backup tapes is one of the most straightforward. The problem is, too few companies, including banks, care enough about your information to take the time, or spend a few extra bucks, to make sure it's managed safely.