Previously, Citigroup said that more than 200,000 cardholders, or about 1 percent of its 21 million North American cardholders, were affected. The new revelations come as the bank was forced to respond to Connecticut’s attorney general and several other state regulators who have opened inquiries into the breach. They join federal authorities, including the Secret Service and the Federal Bureau of Investigation, who have been conducting investigations into how the bank was attacked.  

In the statement, Citigroup also pinpointed May 10 as the date when it discovered the breach, and it said that it had immediately rectified the problem and began an internal investigation. By May 24, bank officials concluded that the data thieves had captured the names, account numbers, and e-mail addresses of about 360,000 customers. Social security numbers, expiration dates, and the three-digit security password found on the back of the card were not exposed — a finding that security experts have said would make it hard for the thieves to commit fraud.

As of May 24, the bank began preparing to replace about 218,000 credit cards and to prepare notification letters to its customers. Those were mailed beginning June 3, but itwaited to notify the public until June 9.

Citigroup said it implemented “enhanced procedures” to prevent similar incidents from happening and also notified law enforcement and government officials. It did not indicate when they were contacted, however.

In its statement, Citigroup reassured customers that they would not be held liable for fraudulent charges and could take advantage of free identity theft protection assistance, available via a phone number on the back of their credit card, if they believed they were a victim. The bank also encouraged its customers to review their account statements and report any suspicious activity.

Citigroup, citing the ongoing law enforcement investigation, provided no additional details about how their system was left vulnerable.  

Article source: http://feeds.nytimes.com/click.phdo?i=89501f186083a2788aef061e75069198