Falciani’s theft covered several months but it is not yet clear how he did it

[correction 13 March] Geneva, Switzerland (GenevaLunch) - The extraordinary under-assessment by HSBC of the number of bank accounts implicated in the theft of data from Geneva begins to make more sense when the timeline the bank provided to the press Thursday 11 March is studied. French authorities and then Swiss have been privy to the data for months, but the bank says its first credible clue about the scope of the theft came only one week ago, 3 March.

Hervé Falciani stole data linked to accounts of some 24,000 clients in Geneva, some 15,000 of whom are still clients, but the bank initially said only 10 accounts were involved. How he did it is still unclear and is under investigation by the Swiss Federal Prosecutor’s office. Falciani is in hiding in France: France, like many countries including Switzerland, does not extradite its own citizens, which puts him out of the reach of Swiss investigators.

Timeline provided by HSBC

• End 2006-beginning 2007: HF (Herve Falciani) works on a migration of client data between systems and takes the opportunity to steal data, probably over a period of months
• Summer 2008: The bank first becomes aware that the Swiss Federal Prosecutor investigates into a possible data theft and that an identified female subcontractor had tried together with an unidentified man to sell data to several banks in Lebanon
• 22 December 2008: a female employee is arrested for questioning; she denounces HF, who is then arrested for questioning. He subsequently flees from Switzerland to France
• Throughout 2009: Following a request for legal assistance sent by the Swiss Federal Prosecutor, the French prosecutor seizes the data at the residence of HF in France, but returns it neither to the Swiss authorities nor to the Bank
• Summer 2009: the Bank is shown an email of HF: a list of 7 names of individuals linked to accounts opened with the bank, containing errors
• Summer 2009: The French Government states that it is in possession of data but refuses to give its sources
• 9 December 2009: Le Parisien publishes a full story and first indications are made of a larger number of client accounts impacted. No evidence of these assertions is provided to the Bank. A press release is distributed
• January, 2010: The stolen data held by the French authorities is returned to the Swiss Federal Prosecutor
• 3 March 2010: Some copies of the stolen data which were held by the French authorities are returned to the Bank by the Swiss Federal Prosecutor. The full extent of the theft is now demonstrated for the first time.

You can leave a response, or trackback from your own site.