Our internet banking product "hiccupped" and attached several accounts to a customer who only had 1 checking account. Do we need to tell those customers who's accts showed up on someone else's profile? It was discovered immediately and remedied. We verified that no money was transferred from the accounts. The Tax ID's were not visible, nor were the complete account numbers except on the 6 checking accounts, where the customer was able to view a statement. There were many loans attached, but the customer couldn't see any personal information on those. Should we notify only those accounts that he had the potential to see statements? Should we notify at all?

California has a statute regarding notification if there has been a disclosure of un-encrypted customer info but I do not know if Texas has the same thing. At this point I am not aware of a federal requirement but I think it is in the works.