NACHA Risk Alert: Notification of ACH Data Breach Incident

July 7, 2009


ACTION REQUESTED

For your information, an ODFI in Cedar Rapids, IA has informed NACHA of a breach of consumer-level data in accordance with NACHA’s Interim Policy on ACH Data Breach Notification Requirements.  NACHA has provided both ACH Operators a list of affected RDFI routing numbers and contact information of the designated ODFI security representative for communications to RDFIs. The ACH Operators will follow their respective procedures to notify their ACH services customers. Copies of both ACH Operators’ alerts will be posted on the members-only portion of the NACHA website as soon as they are made available to NACHA.


This particular incident involves breached data containing the bank account number and bank routing number.

ACH Data Breach Notification Requirements

A copy of NACHA’s Interim Policy on ACH Data Breach Notification Requirements, the Data Breach Notification Form, and the related ACH Operations Bulletin dated August 28, 2007 may be found online at: http://www.nacha.org/DataBreach/default.htm.