Citibank security breach: undisclosed *internally*, let alone publicly?

Following up on yesterday's Boing Boing post about an alleged class break affecting Citibank networks in the US, UK, and Russia, an anonymous Citibank employee says (via Consumerist):

Apparently [us] employees have no details either. A client came into the branch late last week, she was travelling in Canada, and her card stopped working for no reason. She called up Citiphone (the consumer help line – they’re terrible), and they gave her no reason as to why the card was blocked, and had a new card sent to our branch. Since she was in Canada, this really didn’t help her out one bit.

Your article was the first that I heard of this. When she came into the branch to pick up her new card, there were no notes on her account stating why her card was blocked in the first place. There was no internal memo or email sent out regarding this fraud issue.

Link. What is a "class break?" In network security jargon, that's what happens when one breach leads to a whole new "class" of attacks on various systems, using similar methods. When it happens on a global banking network, it's also known as "really bad news." Update: Ben Popken at Consumerist reports that Citibank is now claiming that the breach was not a class break — but acknowledges they've known about it for a month. Link.

Previously on Boing Boing:
Citibank under fraud attack, customers locked out of accounts