Hackers infiltrated the systems of Commerce Bank and accessed the records of 20 customers, the US regional bank said today.

The attack by persons unknown was partially thwarted - but not before a database of 3,000 records was hacked into and the data of 20 exposed. Compromised data included personal information such as names, addresses, Social Security numbers, phone numbers and, in a few cases, Commerce Bank account numbers, the Columbia Business Journal reports.

Security staff shut down the attack and called in police to investigate after uncovering the breach a week ago. The FBI is investigating.

The method used in the attack is unclear, and something the bank will be keen that it stays unclear, to avoid the possibility of copycat attacks. There are many avenues of assault, of which one common tactic is to exploit web application vulnerabilities by using SQL injection attacksto access information of back-end databases.

Commerce Bank has apologised for the breach to customers affected by the attack and is offering to pay for two years' credit monitoring. Concerned customers can call +1 877 279 4046 for more info.

The Midwest bank operates 360 branches in Missouri, Illinois and Kansas and an online banking business. ®

Related stories

• Chinese spammers target 1,200 US, UK firms (11 April 2008)
• Attackers turn Bank of India site into malware bazaar (1 September 2007)
• Banks want data pulled from US (3 July 2007)
• TJX finds self at bottom of 300-bank pig pile (26 April 2007)
• Fraud linked to TJX data heist spreads (29 January 2007)
• Phishers haul in money from Nordic bank (19 January 2007)
• 100m US records exposed by security blunders (18 December 2006)
• Citibank ATM fraud 'just tip of iceberg' - analyst (13 March 2006)