Major Bank Fined $60 Million for Data Protection Failures
Analyzing how lapses in data center decommissioning and vendor management led to massive penalties, class-action lawsuits, and lifetime identity theft risks for customers.
A major global financial institution found itself at the center of public outcry and class-action lawsuits following official disclosure of two separate data breach incidents. These notifications concerning incidents dating back several years attracted multiple class-action lawsuits from over 100 members, with one lawsuit seeking $5 million in damages for unauthorized disclosure of customers' PII and historical data to unknown third parties.
Subsequently, the banking institution was issued a $60 million civil money penalty by federal regulators. The regulator found that the bank failed to adequately address data privacy risks associated with decommissioning data centers, failed to evaluate risks with third-party vendors, and failed to maintain appropriate inventory of customer data stored on devices.
The Two Data Breach Incidents
Incident #1: Data Center Decommissioning (2016)
The first incident involved decommissioning of two data centers without appropriate due diligence in monitoring the third-party vendor contracted for wiping customer data. The vendor allegedly failed to completely erase data from servers and other hardware before selling equipment to recyclers. The bank only learned of residual data's existence on disposed storage hardware years later — through a recycler who discovered the sensitive information.
Incident #2: Missing Servers (2019)
In the second incident, several decommissioned servers at a local branch went missing from inventory. The missing servers' hard disks contained a portion of customers' deleted data in unencrypted form — later attributed to a software flaw. This data was accessible to whomever possessed the missing servers.
Data Exposed
The incidents potentially exposed current and former customers' sensitive data — including account names and numbers, social security numbers, passport numbers, contact information, and dates of birth — creating what lawyers described as a "lifetime risk of identity theft."
Root Causes of the Data Leakage
1. Inadequate Vendor Supervision
The vendor failed to completely remove data from retired devices — a matter that came to the bank's attention years later through a third party. This indicates a critical lapse in supervising contracted data wiping jobs and verifying outcomes against data protection regulatory standards.
2. Absence of Documentation
No systematic documentation existed for the data wipingperformed. The availability of wiping records for every server could have helped the bank serve audit trails and attain regulatory compliance. The vendor apparently didn't provide records attesting to job completeness and efficacy.
3. Technical Lapses in Data Destruction
The 2019 incident involved unencrypted data remaining on missing servers due to a software flaw — a fact revealed only after the software manufacturer informed the bank. The data encryption technology failed to sufficiently meet information protection goals.
How Professional Data Erasure Could Have Prevented This
Adoption of professional data erasure software could have helped the institution preempt this situation in several critical ways:
On-Premises Wiping
Modern data erasure software like D-Secure provides DIY utilities for in-house wiping of legacy storage media with minimal technical assistance. IT asset management teams can wipe hard drives on-premises without special setup — even booting from a USB flash drive to wipe entire drives in approximately 20 minutes.
Secure Pre-Release Processing
Drives wiped using professional erasure software can be released to hardware resellers or recyclers for subsequent processing without worrying about data leakage surprises. Organizations can even reassign wiped drives to third-party vendors for further sanitization without apprehension of due diligence lapses.
Tamper-Evident Documentation
Professional erasure software generates digital reports for every wiped device. D-Secure Drive Eraser produces digitally signed reports that record the device, method and result, which you can keep as supporting evidence for audits.
Complementing Encryption
Data erasure complements encryption by nullifying potential vulnerabilities from technical glitches. Formal inclusion of erasure in data protection policy protects data even when left unencrypted due to software flaws or human errors — exactly what could have prevented the 2019 incident.
Key Lessons for Financial Organizations
Never rely solely on third-party vendors for data destruction without verified processes and documented proof of completion.
Maintain tamper-evident certificates for every device processed, creating supporting evidence for audits.
Implement on-premises erasure before equipment leaves organizational custody to eliminate reliance on external parties.
Use erasure to complement encryption — it provides protection even when encryption fails due to software flaws or configuration errors.
The Imperative for Data Erasure Adoption
Organizations must ramp up data protection policies and practices in tandem with global regulations. The surfeit of data breach incidents over the decade — with ever-growing scales of impact — underscores this fact. The presence of residual data in storage hardware remains a crucial reason for data privacy violations, alongside traditional hacking scenarios.
The only way to eradicate sensitive, unwanted data is to erase it such that no tool or technique can retrieve it. Data erasure technology enables this solution through professional software tools. Beyond wiping assurance through systematic implementation and standards-based records, data erasure also nullifies incidental risks from missing hardware, failed encryption, and vendor mismanagement.
Solutions for Financial
Explore the full D-Secure data security suite
How Do Experts Handle This?
Standard Compliance
Meeting NIST 800-88 and GDPR standards with full audit trails.
Enterprise Ready
Scalable solutions for ITAD partners and large organizations.
Securing Data Everywhere
Trusted by global enterprises for zero-leakage data sanitization.
Comments (0)
Your email address will not be published. Providing an email is optional.
Have Questions About This Topic?
Send us an enquiry regarding: Financial Data Breach Case Study
No comments yet. Be the first to comment.