espite initial reports involving far lower figures, the number of potential victims of the latest incident of stolen identity data could reach 1 million or more. On May 23, 2005, media outlets announced that Bank of America Corp. (BofA) and Wachovia Corp. were notifying 108,000 customers that their account and other personal information could be at risk.

However, the number of people affected by the recent scheme could climb significantly as the case unfolds. According to the "Wall Street Journal," at least 500,000 accounts at 10 or more banks might have been compromised over four years; the San Jose "Mercury News" reported on its Web site it could be as high as 700,000 accounts.

Orazio Lembo, the scheme's alleged perpetrator, paid several bank employees $10 per account they released to him. His company, DRL Associates, sold Social Security and account numbers as well as balance and employment information, obtained from the bank employees, to at least 40 collection agencies and law firms.

Authorities discovered the plot in February when they searched Lembo's apartment in Hackensack, N.J. while investigating an unrelated matter. They exposed the bank record theft on April 28 following the arrest of 10 people, including Lembo and eight bank employees, in connection with the scheme. The number of arrests could increase as well.

According to initial reports, BofA alerted at least 60,000 customers that their names appeared on computer disks seized by police. In early May, Wachovia began to notify 48,000 current and former customers whose account information may have been accessed.

Other banks with customers targeted in the scheme include New Jersey-based Commerce Bancorp, which employed five of the involved bank employees, and PNC Financial Services Group Inc. of Pittsburgh.

Although it's unclear exactly how many people will be affected, there is no sign the breached data were used for purposes of identity theft such as opening accounts or obtaining loans.