“Believe it or not, we really don't like putting out more regs than we need to but we're struggling to determine if there's another way to do this. Of course we're always willing to hear suggestions from the credit union community about how to proceed,” she added.

Matz told CU Times the agency would decide the best way to proceed after the conclusion of the NCUA Inspector General's investigation.

In response to the question of whether the NCUA should have alerted the public as soon as the flash drive was lost, Matz said the agency very carefully followed the U.S. Office of Management and Budget guidance, titled, Recommendations for Identity Theft Related Data Breach Notification.

“There's nothing to be gained from publicizing this type of low level breach because one, it could encourage criminals to approach these individuals and to try to sell them breach protection or other things or try to get information from them,” Matz said. “I mean, it really does encourage criminal behavior, perhaps, and there's really not a benefit to be gained by publicizing it widely.”

Matz said the agency followed protocol after the flash drive was lost.

“It was an unfortunate situation. We do not know what happened to that thumb drive. We don't know if it was accidently discarded or if it is still sitting in somebody's pocket somewhere,” she said.

According to Matz, the NCUA has agreed to bear any costs of providing data protection to the affected members but there has been no sign of unauthorized use of the data.

CU Times asked Matz for an estimate of the total cost the agency would have to pay as a result of the incident.

“It's very low actually. There are 1,600 members who might have been affected by this and whatever the cost of the protection is, I'm guessing $30 or $40 a year per person so we're not talking about a lot of money, we're talking about probably $15,000-$20,000 at most,” Matz estimated. “It's a relatively small amount but whatever it is, we've agreed to cover it.”