Reporter (in Bangalore) cites his source as Financial Times.

Googling offers: http://www.ft.com/cms/s/0/885a54e8-9225-11e0-9e00-00144feab4...

Which says, "The US bank on Wednesday revealed details of the breach...

And MarketPlace.com is similarly unforthcoming: "Citi reportedly said it discovered the breach in early May, and that it had affected about 1% of its card customers, according to a report in the Financial Times, citing a Citi statement." Link:

http://www.marketwatch.com/story/citi-customer-data-exposed-...

And Reuters says little more. That's (to me) one of big disappointments of journalism (on/offline): lack of citation for further investigation.