BOSTON Two Massachusetts newspapers, The Boston Globe and the Worcester Telegram & Gazette, said Tuesday that slips containing the names and credit card numbers of tens of thousands of customers were accidentally delivered with bundles of papers on Sunday in Worcester.
Both papers are units of the New York Times Co.
A convenience store clerk first notified the newspapers of the security breach on Monday. It took until late Monday for officials to confirm the data were, indeed, credit and debit card numbers. Senior managers learned of the security breach Tuesday morning.
"We deeply value the trust our subscribers place in us and we are working diligently to remedy this unfortunate situation," said Richard H. Gilman, publisher of The Boston Globe, in a statement. "Immediate steps have been taken internally at the Globe and Telegram & Gazette to increase security around credit card reporting."
The papers said the slips also contained routing information for 1,100 of its customers who pay by check.
The newspapers are still investigating their procedures for handling confidential customer information. But a representative said employees were not disciplined because the errors were inadvertent. "There's no reason to believe this was intentional," he said.
Officials of the newspapers said they were notifying customers of the mistake, which may have affected as many as 240,000 subscribers.
The financial data was on the back side of paper that had inadvertently been recycled and used for routing slips or "toppers" in 9,000 large bundles of the Telegram & Gazette distributed on Sunday to 2,000 retailers and 390 newspaper carriers.
The company has notified American Express, Discover, MasterCard, Visa and any banks whose customers may be affected. "There have been no reports of any unauthorized uses of credit card information," Globe vice president Al Larkin said.
The newspapers posted notices to customers at the top of their Web sites late Tuesday. The Globe stated: "About 227,000 subscribers pay by credit or bank cards, although it's unclear exactly how many had their information released."
The Worcester paper, after describing the overall problem, revealed: "No single customer name was distributed on any more than two bundles. The routing slips are typically discarded shortly after the bundles are delivered."
—Editor & Publisher staff report