Case study
A private bank after a data exposure
Advising a private bank with offices in London and New York after a supplier’s error left client statements readable online for six days.
The situation
In June 2023 a private bank with offices in London and New York learned from one of its own clients that his quarterly statement could be opened by anyone who had the link to it. A supplier that printed and distributed the bank’s statements had changed a setting six days earlier. The statements of 2,941 clients had been exposed in the same way.
The bank’s clients are people who value discretion above almost everything, and several of them are well known.
What we did
We advised the bank to tell every affected client before anyone else, by telephone where it could and by letter from the chief executive where it could not, and to tell them exactly what had happened, including the number. The regulators in both jurisdictions were told on the same day.
Our digital listening team watched for any sign that statements had been found or shared. None was. We prepared a short statement for the press in case the story emerged; it was never needed, because the bank’s clients heard it from the bank.
From the work
A small number of clients may have been affected by a technical issue at one of our suppliers.The statements of 2,941 clients, including yours, could be opened by anyone who had the link to them between 7 and 13 June.
Outcome
The bank found no evidence that any statement had been opened by anyone other than the client it belonged to. Fourteen clients closed their accounts; the bank had expected several hundred to.
Telling clients the number felt like the riskiest thing we could do. It was the reason they stayed.
Case studies are published with our clients’ agreement and without their names. Details that would identify a client have been left out or changed.