Aug. 29--A security breach that occurred in February and surfaced publicly in May -- in which the Bank of New York Mellon lost unencrypted personal information on millions of consumers nationwide, including hundreds of thousands of People's United Bank customers -- is vastly more widespread than originally thought.

BNY Mellon spokesman Kevin Heine said Thursday about 12 million people nationwide may be affected by the breach. The new estimate -- triple the 4 million the bank previously announced in the spring -- was triggered by an earlier announcement in which Gov. M. Jodi Rell said state officials feared the number had swelled to 10 million.

It is unclear how many Connecticut residents are affected, Heine said, but that information may be available next week.

According to Rell, state officials learned of the breach's broader scope after the state Department of Consumer Protection subpoenaed both BNY Mellon and People's for information.

"It is simply outrageous that this mountain of information was not better protected," Rell said, adding the delay in reporting additional victims is "equally outrageous. We fear a substantial number Connecticut residents are among this latest group."

BNY Mellon officials said they are notifying everyone whose personal information is at risk. There is no indication the data has been accessed or misused in any way, according to the bank. All consumers who receive noti- fication from the bank will be eligible to receive free identity theft and fraud protection.

The bank has set up a Web site, www.bnymellon.com/tapequery, for consumers seeking more information and guidance.

BNY Mellon officials said they learned about the additional affected consumers following a "forensic review" of the data.

"We sincerely regret this incident occurred and are fully committed to offering comprehensive fraud protection assistance to all individuals identified in our recent forensic review of the data," Brian Rogan, the bank's chief risk officer, said in a written statement. "We are actively engaged in a top-to-bottom review of our security policies and procedures ... and we are taking the steps necessary to ensure we have industry-leading security measures in place across all of our businesses."

But state officials are unhappy with the delay.

"Had the hundreds of thousands of Connecticut residents affected been notified immediately that their data had been compromised, they could have taken steps to protect themselves," Rell said.

Consumer Protection Commissioner Jerry Farrell Jr. agreed, saying: "This certainly raises serious additional questions about how secure personal identifying data is at the Bank of New York Mellon and widens the scope of our investigation."

The security breach occurred in February but traces back even further. In 2007, People's gave a tape containing confidential information -- including Social Security and bank account numbers -- to BNY Mellon, when People's was going public. People's, of Bridgeport, hired BNY Mellon to screen depositors to ensure they met the requirements for buying stock in the conversion.

People's spokesman Brent DiGiorgio said that, while the information given to BNY Mellon was encrypted, the backup tape made by BNY Mellon was not. On Feb. 27, BNY Mellon gave the backup tape, along with nine other tapes, to a storage firm called Archive Systems Inc. to be transported to a storage facility -- but the tape was missing when the delivery truck arrived at the facility.

People's officials have said they were notified of the breach May 13. Word of the security breach surfaced publicly soon after, brought to light by state Attorney General Richard Blumenthal. It has spurred a class action lawsuit from customers holding individual and business accounts with People's. The lawsuit was filed in Superior Court in Bridgeport in May against People's and BNY Mellon.

State officials are continuing to investigate the matter.

-----

To see more of New Haven Register, or to subscribe to the newspaper, go to http://www.nhregister.com.

Copyright (c) 2008, New Haven Register, Conn.

Distributed by McClatchy-Tribune Information Services.

For reprints, email tmsreprints@permissionsgroup.com, call 800-374-7985 or 847-635-6550, send a fax to 847-635-6968, or write to The Permissions Group Inc., 1247 Milwaukee Ave., Suite 303, Glenview, IL 60025, USA.

NYSE:BK,