A Citigroup spokesman on Thursday didn't rule out the possibility of fraudulent charges on the accounts, which Citi said represent about 1% of its North American bank card customers. The spokesman added that fraud protection covering unauthorized use should apply in such cases. Citi has 21 million credit-card accounts.
The information subject to the unauthorized access included holders' names, account numbers and email addresses, Citi said. But the breach didn't compromise additional personal information such as Social Security numbers, date of birth, and card security codes or expirations. A spokesman said Citi's debit cards weren't affected.
"The company said roughly 1% of customers' accounts were viewed but didn't estimate the actual number affected.