2007 — JPMorgan Chase: The personal information of approximately 2, 2.6M records
Technical writeup
May 2007. The personal information of approximately 2.6 million current and former holders of a Chase-Circuit City credit card had been mistakenly identified as trash and thrown out in garbage bags outside five branch offices in New York.
Root cause
Lost / stolen device