Slashdot Mirror
American Express Warns Customers About Breach -- From 2013 (csoonline.com)
itwbennett writes: In a notification letter dated March 10, American Express warned cardholders that their account information might've been exposed after a third-party service provider suffered a data breach — in December 2013. The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
I am faster than American Express.
Isn't there a law on the books yet about timely notifications?
The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
Probably because some of the data from the breach was recently seen on the various black-market sites that sell the information.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
The longer it takes, the more interests they charge
Unlike Visa and Mastercard, who do nothing but process cards and pass all the lending risk to the banks, American Express loans out their own money. They know about a breach and fail to do anything about it, they're the ones eating the bill.
someone forgot to put a cover sheet on the TPS report. ;)
Anons need not reply. Questions end with a question mark.
That's funny, because the first thought I had was the custom development my ex-employer did for Amex. All the code written in North America by employees/owners.
The owners code was shit however.
Big company data breaches these days pretty regularly expect lawsuits to result. While some of them (Amex is probably included) mostly avoid responsibility by including no-class-action and arbitration clauses in their contracts, they are still going to make sure every word of an announcement like this is vetted by their litigation counsel.
That means that explanations that may be used against them in court are not going to be included.
It also means that this announcement is written to consumers, but it is also, and more honestly, directed at a future judge or jury.
There simply has to be some way that a second party can be paid without without revealing details about the first party. Hopefully somebody is working on a solution to this obvious weakness in secured transactions.
Time is what keeps everything from happening all at once.
I already noticed when I got my credit card bill years ago with a ton of fraud charges. My situation might have been unique as I'd never used my Amex card (being in Canada, there aren't a lot of places that take it). They told me they already knew that I had been a fraud victim and reversed all the charges without be having to do anything.
Website Just Down For Me? Find out
They ran out of gas!
Th -- they had a flat tire!
They didn't have enough money for cab fare!
Their tux didn't come back from the cleaners!
Some old friend of theirs came in from out of town!
Someone stole their car!
There was an earthquake!
A terrible flood!
Locusts!
Hackers!
IT WASN'T THEIR FAULT, THEY'VE SWORN TO GOD!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Whomever this company is needs to be named. TFA mentions that this is the same data Affinity Gaming reported, and now their suing the ITSEC corp Trustwave whom they hired to contain the breach since Trustwave failed and Affinity got hit again. This article says that it was a breach of the card processing system used for non-gambling (hotel, food, etc) purchases, so it appears this "third party" is a credit card processor that sits in between Affinity and AMEX.
I'm betting AMEX isn't the only card company hit in this, but there are so many data breaches unless you work in credit card ITSEC you probably don't keep good enough track of it all to tie it all together. It could be CK Systems, they are a CC processor that got hit in 2013.
Woosh...
Class action suit? Sue the bastards!!!!!!!!!!
Amex sent me the letter regarding the breach. After seeing they wanted me to closely watch my account activity for the next 12 to 24 months, I concluded I it was more effort than I was willing to expend. I contacted Amex to get more information regarding the breach. They, understandably, would not / could not offer more information and stated there is an ongoing investigation. After telling the nice lady their recommendations were more than I was willing to do, I asked for a replacement card. It was either a new card or I was willing to zap the chip, cut the card and put it into a drawer for the next two years.
These companies that do not provide sufficient security should be burnt to the ground. We could start with every other Home Depot to set an example.