Northern Trust northerntrust.com Northern Trust data breach: what happened and what to do
On May 17, 2014, a Northern Trust employee sent an encrypted file of retirement plan participant data to a record-keeping company, and the company notified affected people in July 2014. The file held names, addresses, Social Security numbers and benefits account numbers.
View all 13,177 breaches- Breach date
- 17 May 2014
- Made public
- 29 Jul 2014
- Data exposed
- Names, Physical addresses, Social security numbers, Benefits plan account numbers, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On May 17, 2014, a Northern Trust employee sent a file containing plan participants' personal information to one of its record-keeping companies, according to the company's July 29, 2014 letter to Hawaii's Office of Consumer Protection. The letter says the file was sent in encrypted form. The incident also appears on the California Attorney General's breach list with a breach date of May 17, 2014.
Northern Trust told Hawaii the incident didn't meet that state's legal threshold for notifying residents, but it chose to notify the 1,267 Hawaii residents involved anyway. That figure covers one state only. The sources used for this page don't give a total for everyone affected.
Sources checked: cca.hawaii.gov, oag.ca.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The letter lists participant names, addresses, Social Security numbers and benefits plan or program account numbers, and in some cases bank routing and account numbers.
A name, address and Social Security number together are enough for someone to apply for credit in another person's name. Bank details add the risk of fraudulent withdrawals or transfers, so statements are worth watching.
What to do
If you got a notice from Northern Trust about this, follow the steps in it, including any credit monitoring it offers. The steps below are the FTC's standard advice after a breach involving a Social Security number.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. According to the FTC, a freeze stops lenders from seeing your credit report, which blocks most new accounts in your name, and lasts until you lift it.
- 2
Check your bank statements
If your bank details were involved, review statements for transfers you don't recognize and tell your bank if anything looks wrong.
- 3
Use free credit monitoring if offered
The FTC recommends taking free credit monitoring when a breach notice offers it. Check your letter for the sign-up steps and deadline.
- 4
Report identity theft
If someone uses your information, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see where your email or phone number has shown up. Serus can't remove data from a breach, but it alerts you and tells you what to do.
Official filings
- California Attorney General , filed 29 Jul 2014
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Northern Trust breach?
Affected people were notified by letter in July 2014. If you took part in a retirement or benefits plan administered through Northern Trust and want to check, contact the company directly.
What was exposed?
Names, addresses, Social Security numbers and benefits account numbers, and in some cases bank routing and account numbers.
How many people were affected?
The sources used for this page give no total. Northern Trust told Hawaii that 1,267 residents of that state were involved.
Should I freeze my credit?
If you were notified, a freeze is a sensible step since Social Security numbers were involved. The FTC says it's free.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
