Idahoans were victims of a recent bank hacking. Why the attorney general didn’t know
When Boise resident Nick Ballenger paid off his KeyBank property mortgage, he never imagined that years later information from that account would be stolen by hackers.
Customers who opened a mortgage through Cleveland-based KeyBank had their data stolen when someone hacked into a third-party insurance service business used by the bank known as Overby-Seawell Co. That stolen information included names, mortgage property addresses and information, mortgage account number and information, home insurance policy number and information, phone numbers, and the first eight digits of Social Security numbers.
“I trusted them with my financial and personal information and they let hackers have access to it,” Ballenger said. “I know KeyBank is trying to take a second seat, saying it wasn’t their fault, it was a vendor’s fault. But when a customer gives them their private information, they’re trusting the bank to safeguard it.”
The data breach happened on July 5. KeyBank said Overby-Seawell alerted the bank on Aug. 4, according to a letter dated Aug. 26 that Ballenger received from KeyBank. Because there was nothing on the envelope indicating it was important information, Ballenger said he did not open it right away.
Ballenger now fears that hackers have enough personal information to damage his credit and finances.
“Someone could open bank accounts, credit card accounts, charge accounts, take out small loans, take out a mortgage,” Ballenger said. “They’ve got everything they need to open up accounts on my name.”
When Ballenger tried to call the bank, he said a customer service agent simply read him scripted answers.
In a letter to customers, KeyBank, whose website says it holds $186 billion in assets, said it was letting Overby-Seawell handle the investigation. It advised customers to closely monitor their accounts and offered access to Equifax Complete Premier services to help detect possible misuse of information.
“It’s like the bank has assigned me a part-time job to monitor my financial health,” Ballenger said. “...They gave a free account to one of the credit reporting agencies. I’ve already got those accounts. Big deal. What they could offer is to monitor any unusual activity that happens for me. They could promise that if I suffer any losses, they’ll reimburse me. There’s a lot of things I could do to make me feel better about it. But they didn’t.”
Ballenger said he has decided to close his KeyBank accounts because of the “callous” way the bank handled the data breach.
A KeyBank representative pointed out that its company was not the one through which hackers obtained the information.
“This incident does not affect any Key systems or operations,” Jeff Kew, KeyBank communications senior consultant, said in an email to the Idaho Statesman. “(Overby-Seawell Co.) has reported this matter to law enforcement and we are working to make sure that enhanced measures are in place to protect our data. We take this matter very seriously and have notified all affected individuals.”
Because of Idaho consumer protection laws, information on how many Idahoans were affected is not publicly available. KeyBank declined to give that number to the Idaho Statesman.
“Apologies, but we’re not getting into that information right now,” Kew said in response to a Statesman request for the number of Idahoans affected.
Idaho is one of just seven states that does not require businesses to notify state regulators of a data breach. While affected customers must by law be notified, only state agencies must contact the Idaho attorney general’s office in such cases.
Some businesses still choose to notify the office despite the lack of requirement. In 2022, 53 state agencies and businesses so far have notified the attorney general’s office about data breaches that affected Idahoans. KeyBank had not notifed the attorney’s general office as of Thursday.
These data breaches are becoming all too common, according to Stephanie Guyon, a deputy attorney general who overseas the office’s Consumer Protection Division.
“They just keep happening over and over,” Guyon said. “And they’re going to probably keep getting even more common, because there’s so much personal information out there that we supply.”
Guyon advises people to use safeguard themselves by using credit monitoring services so they can find out as soon as possible when someone may be using their information. Guyon said at that point, freezing one’s credit can protect it from further damages.
Overby-Seawell did not return an emailed request for comment.
