Chase Card Services reported yesterday that it inadvertently threw out storage tapes last July containing the personal information of 2.6 million current and former Circuit City credit card account holders.
Attributing the data-trashing to human error, company officials believe that the tapes, contained within a locked box, were compacted, destroyed, and buried in a landfill. The company reports working with federal and local law enforcement to investigate the fate of the data and says that thus far, at least, the personal data has not been misused.
"We deeply regret that this has occurred and apologize to those impacted," said Rich Srednicki, CEO of Chase, in a written statement. "The privacy of our customers' personal information is of utmost importance to us, and we take the responsibility to safeguard this information very seriously."
By the way, according to reports, the company will not disclose whether the data was encrypted. (I'll draw my own cynical conclusions from that, based on the number of other companies that have suffered spills of unencrypted data lately.)
The company began notifying affected individuals yesterday. The process will take up to three weeks. To those customers whose Social Security numbers were on the tapes, Chase will offer what's become the de facto consolation prize: a year of free credit monitoring service.
Chase also said that it will continue to monitor the affected accounts, and that it has "has strengthened a number of security procedures and is currently conducting a comprehensive review of all data storage and protection processes."