Commonwealth Bank reported 20 million bank accounts may have been compromised, after a sub-contractor failed to destroy the records in 2016.
The personal details, which included names, addresses, account numbers and statements, were stored on two magnetic tapes intended for deletion.
However, the bank failed to inform customers of this potential issue, despite being aware of the oversight.