Citigroup Inc. waited as long as three weeks to notify credit-card customers of a hacking attack because it was conducting an investigation and producing replacement cards, according to a person familiar with the situation.
The internal investigation took 10 to 12 days and began within 24 hours of the discovery by Citigroup officials in early May that the New York bank's systems had been breached, this person said. In some cases, Citigroup took action to protect accounts considered vulnerable to fraud.
Advertisement