A former IT employee of Swiss subsidiary HSBC Private Bank (Suisse) SA, identified by French authorities as Herve Falciani, obtained the information between late 2006 and early 2007, the bank said. The accounts, held by individuals worldwide, were all opened before October 2006 and some 9,000 have since been closed.
"We deeply regret this situation and unreservedly apologize to our clients for this threat to their privacy," said Alexandre Zeller, chief executive of the Swiss subsidiary.
Switzerland has some of the world's strictest laws on banking secrecy, and the Swiss Financial Market Supervisory Authority, or FINMA, said Thursday it has opened an investigation into whether HSBC failed to meet legal requirements to prevent data theft.
The bank said it has contacted the affected customers and doesn't believe the data has or will allow any unauthorized person to access the affected accounts. The stolen information only affects accounts in Switzerland with the exception of its former subsidiary HSBC Guyerzeller Bank, it said.
However, the theft could leave some of those account holders exposed to prosecution by tax authorities if they failed to declare the assets in their home countries.
In recent cases of data theft from banks in Switzerland and Liechtenstein, the information was offered to foreign governments seeking to track down nationals who avoided paying their taxes by hiding money in Swiss accounts.
The French government said last year it had obtained a list of 3,000 French HSBC clients compiled from "numerous sources," including from Falciani, who had been identified by prosecutors in the French city of Aix-en-Provence.
France later agreed to return the files to Switzerland, who in turn handed "copies of a significant portion of the data" back to the bank on March 3, HSBC said. "Based on the facts it would appear that the French authorities have copies and the Swiss authorities have copies," HSBC spokesman Jezz Farr said.
The bank said French authorities had informed their Swiss counterparts that the data they still hold would "not be used inappropriately." It remained unclear whether that means France will not use the data to prosecute tax evaders.
Farr said the theft affected customers worldwide. "The accounts were held in Switzerland but the client base is international," he said.
HSBC PLC said offering private banking services for rich customers remains "a core business" of the group, which has about 100,000 private banking clients.
Shares in HSBC were down 0.1 percent at 6.98 pounds ($10.48) on the London exchange.
