Australian bank: Customer records cannot be found

The largest bank in Australia admitted Thursday it had lost customer records for almost 20 million accounts.

The Commonwealth Bank said in a statement it had failed to track down two magnetic tapes on which the information was recorded and which had been set aside for destruction in May 2016. The tapes were supposed to be destroyed by a sub-contractor after the decommissioning of a data center, but the lender never received documentation to confirm this happened.

The tapes in question held customer details including names, addresses, account numbers and transactions made between 2000 and 2016.

According to the bank, they did not contain any passwords or PIN numbers which could be used to enable account fraud.

Keeping mum about it

"We undertook a thorough forensic investigation, providing further updates to our regulators after its completion," said the lender's acting head of retail banking, Angus Sullivan.

"We concluded, given the results of the investigation, that we would not alert customers; we take the protection of customer data very seriously and incidents like this are not acceptable."

Australian Prime Minister Malcom Turnbull called the incident "an extraordinary blunder" and insisted customers should have been informed.

"Maintaining data security is of vital importance for everybody, whether it's the private sector or governments, and if there's a serious breach or loss, the people affected should be advised so they can take steps to protect themselves," Turnbull said.

Not the only headache

The latest revelation is another blow to the Commonwealth Bank, which is already reeling from several other scandals.

Earlier this week, regulators slammed the lender for being dismissive of rules and lacking zeal in providing oversight, following a money-laundering scandal last year.

A couple of weeks ago, a royal commission inquiry probing the financial sector rebuked the bank's wealth management arm for charging thousands of customers fees for services that it did not provide.

hg/jd (AFP, dpa)