Bank of America data breach: Infosys subsidiary blamed for exposing 57,000 users' information

Bank of America data breach: Infosys McCamish Systems (IMS), a subsidiary of the Indian software services giant Infosys, has been named as the source of a data breach affecting over 57,000 users of Bank of America. The incident, which occurred on October 29, 2023, was discovered the following day, prompting Bank of America to file a data breach report with the Office of the Maine Attorney General.

The incident, believed to be a ransomware attack, compromised sensitive personal information, including names, social security numbers, and other account details. The breach notification, filed on behalf of Bank of America by an outside attorney, describes the nature of the incident as an "External system breach (hacking)" resulting in the unauthorised access of personal information, including names and Social Security Numbers (SSN) of affected individuals.

“It is unlikely that we will be able to determine with certainty what personal information was accessed as a result of this incident at IMS. According to our records, deferred compensation plan information may have included your first and last name, address, business email address, date of birth, Social Security number, and other account information,” Infosys McCamish Systems LLC said in a statement.

IMS became aware of the cybersecurity event on November 3, 2023, leading to the non-availability of certain IMS applications. Further investigation revealed that data concerning deferred compensation plans serviced by Bank of America may have been compromised. However, Bank of America's systems remained uncompromised throughout the incident.

In response to the security incident, Bank of America is offering affected users a complimentary two-year membership in an identity theft protection service provided by Experian IdentityWorksSM, according to a report. This service includes daily monitoring of credit reports, internet surveillance, and resolution assistance for cases of identity theft.