Slashdot Mirror
8000 Credit Cards' Details Compromised In Australian Bank Breach
mask.of.sanity writes "Australia's largest bank, the Commonwealth Bank, has cancelled 8,000 credit cards after it detected a data breach at a merchant. Mastercard and Visa may issue penalties including fines to the acquiring bank under the payment industry's PCI-DSS compliance rules. News of breaches is uncommon in Australia because the nation does not have data breach disclosure laws."
I can't wait until this is wrongly attributed to "Anonymous" (which is more of a subculture than a group, anyway)
Le français vous intéresse?
But this was not the work of we, who are ANONYMOUS !!
Thank you for thinking of us,
Betty
I don't get why so many stories are spinning this as though it's somehow CBA's fault. CBA detected the data breach, alerted the public, and cancelled affected cards. They failed to name and shame the company that suffered the breach, only indicating that it was a bank outside Australia. CBA deserves some credit for handling the situation as well as they could.
The worst part there will be people who don't know there cards were canceled and try to use it. It will not be a happy sign especially if they did not bring enough cash or a different card to pay with. So I wonder if they will be compensated or can sue for such damages. I know I would if it gets me into any trouble ether with the law or a restaurant or store because I found out my card was not valid a little to late.
So who was the merchant? I'm not a CBA customer but if it was a merchant who had a breach, surely it isn't just CBA customers who were affected?
In the last two years I have been given a replacement credit-card from the NAB bank twice.
One day everything work fine, the next day they don't work anymore and three days later when you call them they say that they are in the process of re-issueing them.
Thanks for not letting me know on day one, and thanks for not being able to buy anything for two weeks.
bash$
TFS mentions that "Mastercard and Visa may issue penalties including fines to the acquiring bank ". Why is that when the breach didn't occur at the bank, but at a merchant?
All of the big 4 had to cancel and re-issue a heap of cards not just the Commonwealth Bank.
My internetting is no good.
*smirk*
the awful behaviour of banks in the US that go to extreme lengths to blame the credit card holder
here we have a bank outside the US that should be a decent example of what banks should do
- tell your customers that their cards no longer work and why
- priority issue them new cards as they may be reliant on the credit cards
- don't name who screwed the pooch. customers can contact the bank if they want more info
- the bank absorbs the cost of the fraudulent transactions (kept low by picking up on the activity early)
the actual story here is a bank (not cba) was requesting transactions into a merchant account
the commonwealth bank analysis software detected something very suspicious with the transactions
it subsequently cancelled all associated credit cards being used preventing further fraudulent transfers
it immediately generated new cards to issue those who were affected
it's unknown if other banks have detected similar transactions on their customers cards
frankly this could be a side effect of the psn breach for all we know
it might just be that other banks haven't detected / admitted the customers cards have been compromised
As a reminder, the Sony hack involved 12.3 million credit cards. This isn't counting the 77 million people who 'just' had their data stolen.
This hack is less than one fifteen hundreth in scope (1/1500th). To put it in car analogy form, if Sony's breach was a quarter mile drag race, CBA's breach would be rolling 10 inches forward at a stop light.
This doesn't mean that every breach of data is deplorable. Just remember how bad the Sony breach was.
The fact that a most credit card transactions are based upon a couple magic numbers and a date makes them easy to defraud. Fixing this problem isn't rocket science. With smartcards, crypto and near field readers this problems shouldn't be hard to make this go away. A vender generates a transaction, you digitally sign it and the vendor gets the signed result. You could even put the credit institution in the loop if you wished. Its funny but Google appears to be pushing the technology that would facilitate this. That would make google stops a buy and visa a sell for the longer term wouldn't it?
As a reminder, the Sony hack involved 12.3 million credit cards. This isn't counting the 77 million people who 'just' had their data stolen. This hack is less than one fifteen hundreth in scope (1/1500th). To put it in car analogy form, if Sony's breach was a quarter mile drag race, CBA's breach would be rolling 10 inches forward at a stop light. This doesn't mean that every breach of data is deplorable. Just remember how bad the Sony breach was.
Incidentally, did you realise it's the commonwealth bank.
My ism, it's full of beliefs.
'The Commonwealth Bank has cancelled some 8000 credit cards after it detected a data breach at a merchant .. The bank did not release the name of the affected merchant and its acquiring bank, or when the breach occurred.
“[CommBank] continuously monitors all credit card transactions to protect our customers from fraud and during this process we became aware of a potential credit card compromise through an Australian merchant acquired by another bank,”
So, it took CommBank to noticed the fraudulent transactions and inform the client before they even noticed anything wrong. Which begs the question as to what technology they were running their system on.
"Banking sources would not identify the merchant or bank involved, however St George Bank emerged as the only institution that would not flatly deny it was the bank in question."
' St.George Bank Cuts Server Deployment and Management Costs with Virtualized Infrastructure'
8000 credit cards? Wow, that's twice as many cards as were stolen from TJX Companies in A SINGLE HOUR between 2005-2007.
Australia, I love you. You're both terrifyingly tough and adorably tiny. Like a snarling chihuahua.
You might also choose to remember that there were no reports of fraudulent charges on the cards that were involved because the security codes required to use the card were not taken.. just something to keep in mind when you're trying to flame Sony.