Citigroup Inc. has told government officials that about 3,400 of the customers whose credit-card information was hacked have suffered about $2.7 million in losses, according to people familiar with the matter.
The disclosure is the first acknowledgment by the New York company that the May security breach resulted in any losses. Citigroup has previously indicated it would cover any losses, saying customers wouldn't be liable for unauthorized use of their accounts in connection with the attack.
The accounts where losses occurred amount to less than 1% of the cards affected by the breach and 0.01% of Citigroup's outstanding credit cards in North America.
Citigroup announced the data breach on June 9 and said six days later that "data that is critical to commit fraud was not compromised," including Social Security numbers, birthdates and card expiration dates and security codes.
But the hackers did obtain card numbers, account names and emails that could have been used with resources that were improperly obtained through other means to cause losses, one person familiar with the breach said.