Kersch explained that Sullivan had been a nine-year employee with the firm and had passed background checks when hired that looked for any prior criminal convictions, drug abuse and credit rating. She said that the data generally included names and addresses of checking account holders and sometimes account numbers as well. However, the account numbers, she said, appeared not to have been sold.

Sullivan could not be located to comment on the allegations.

"It has come as a real shock given that he was a trusted employee and with us for nine years," Kersch said. She emphasized the company did not believe this alleged theft had been going on for very long.

But Kersch explained as well that FIS only became aware of the potential breach in its security after being contacted by one of its retail clients that used its Certegy Check Services check authorization service. Kersch said that the retailer had been contacted by one of its customers irate over how much junk mail they received after every time they shopped at that store.

Since the retailer knew it had not shared any of its customers' information, the information must have come from Certegy. After confirming that it had not been hacked from outside, FIS launched an internal investigation that eventually pinned the blame on a nine-year database administrator who has since been fired. She acknowledged that were it not for the irate consumer, the problem could have continued for some time.

Kersch said Sullivan had been one of five administrators who had that level of access to the company's data and that FIS had acted to strengthen its internal controls by removing laptops from database administration, disabling the ability to download data to third party devices such as flash drives and instituting spot checks on computers with high access to data.

The company has been working with banks and credit unions to mitigate the possible impacts of the breach and stressed that there was no evidence the data had been used fraudulently.

"All the firms which purchased the data were and are reputable direct marketing firms and have been cooperating with our investigation and effort to repair the damage," Kersch said.

The steps FIS is taking include notifying federal and state agencies of the breach as well as the three major credit bureaus and Visa and MasterCard. It has begun working with credit unions and banks to notify them as to the compromised information so that they can put fraud watches into place.

The firm will also contact impacted consumers directly and has established a toll free hotline to answer questions about the breach.

–[email protected]