Update: Citigroup loses data on 3.9 million customers

Citigroup is advising some customers to take steps to protect their identity following the disappearance of a package containing credit information on 3.9 million of the company's CitiFinancial Branch Network customers.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

The data, which contains customer names, Social Security numbers and payment history information, was stored on computer tapes being sent via United Parcel Service (UPS) to a credit bureau, Citigroup said in a statement released Monday. Citibank is now mailing a letter to affected customers, advising them of the situation and offering a number of tips on how they can prevent identity theft.

One such tip: "Do not send sensitive information unless it is encrypted on a secure Web site."

The New York-based Citibank appears to be taking that piece of advice to heart. Beginning next month, it will begin sending credit bureau data "electronically in encrypted form," the company said in a statement.

In addition to data on U.S. CitiFinancial Branch Network customers, the tapes contain information on closed CitiFinancial Retail Services accounts. Citibank has no reason to believe that any of its missing data have been used inappropriately, the statement said.

Because of the sensitivity of the missing information, Citigroup and UPS have informed "a number of law enforcement agencies and regulatory authorities," said Norman Black, a UPS spokesman.

UPS is still trying to understand how the package went missing, Black said. "We're delivering on average 14.1 million packages every day and the technology that we have today is such that it is very unusual for us to find ourselves in a situation where we literally can't find a package," he said. "We have to determine... what did go wrong so we can fix it."

The package containing the unencrypted tapes was shipped from Weehawken, New Jersey, on May 2, destined for an Experian Information Solutions office in Allen, Texas. Experian informed Citigroup that it had not received the package on May 20, and after consulting with UPS, Citigroup on May 27 notified the U.S. Secret Service that the package had been lost, a Citigroup spokesman said.

This marks the second time in recent months that tapes containing large quantities of personal information have gone missing in transit. In March, Time Warner blamed data storage company Iron Mountain. for the disappearance of a shipment containing details on about 600,000 current and former employees.