Slashdot Mirror
American Express Warns Customers About Breach -- From 2013 (csoonline.com)
itwbennett writes: In a notification letter dated March 10, American Express warned cardholders that their account information might've been exposed after a third-party service provider suffered a data breach — in December 2013. The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
Probably because some of the data from the breach was recently seen on the various black-market sites that sell the information.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
Unlike Visa and Mastercard, who do nothing but process cards and pass all the lending risk to the banks, American Express loans out their own money. They know about a breach and fail to do anything about it, they're the ones eating the bill.
Big company data breaches these days pretty regularly expect lawsuits to result. While some of them (Amex is probably included) mostly avoid responsibility by including no-class-action and arbitration clauses in their contracts, they are still going to make sure every word of an announcement like this is vetted by their litigation counsel.
That means that explanations that may be used against them in court are not going to be included.
It also means that this announcement is written to consumers, but it is also, and more honestly, directed at a future judge or jury.
There simply has to be some way that a second party can be paid without without revealing details about the first party. Hopefully somebody is working on a solution to this obvious weakness in secured transactions.
Time is what keeps everything from happening all at once.
I already noticed when I got my credit card bill years ago with a ton of fraud charges. My situation might have been unique as I'd never used my Amex card (being in Canada, there aren't a lot of places that take it). They told me they already knew that I had been a fraud victim and reversed all the charges without be having to do anything.
Website Just Down For Me? Find out
They managed to get the email out before the Milky Way collapses into the massive black hole at its center, so yes, it's timely.
Sleep your way to a whiter smile...date a dentist!
In socialist Europe, a data breach exposing customer confidential data or financial data that isn't reported to the relevant authorities and the customers within 3 days opens the company to large fines (up to 4% world-wide revenue of the company/group), a lawsuit and up to 20 days in jail for the management.
They ran out of gas!
Th -- they had a flat tire!
They didn't have enough money for cab fare!
Their tux didn't come back from the cleaners!
Some old friend of theirs came in from out of town!
Someone stole their car!
There was an earthquake!
A terrible flood!
Locusts!
Hackers!
IT WASN'T THEIR FAULT, THEY'VE SWORN TO GOD!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Whomever this company is needs to be named. TFA mentions that this is the same data Affinity Gaming reported, and now their suing the ITSEC corp Trustwave whom they hired to contain the breach since Trustwave failed and Affinity got hit again. This article says that it was a breach of the card processing system used for non-gambling (hotel, food, etc) purchases, so it appears this "third party" is a credit card processor that sits in between Affinity and AMEX.
I'm betting AMEX isn't the only card company hit in this, but there are so many data breaches unless you work in credit card ITSEC you probably don't keep good enough track of it all to tie it all together. It could be CK Systems, they are a CC processor that got hit in 2013.
Woosh...
There's no indication that American Express themselves were compromised. They can only notify their cardholders once the third-party service provider tells them something happened. My guess is that the service provider didn't know until recently.
I don't know but what I know for sure: When you deal with them, you are contractually obligated to report any security breaches as soon as you notice them.
Everything I write is lies, read between the lines.
Amex sent me the letter regarding the breach. After seeing they wanted me to closely watch my account activity for the next 12 to 24 months, I concluded I it was more effort than I was willing to expend. I contacted Amex to get more information regarding the breach. They, understandably, would not / could not offer more information and stated there is an ongoing investigation. After telling the nice lady their recommendations were more than I was willing to do, I asked for a replacement card. It was either a new card or I was willing to zap the chip, cut the card and put it into a drawer for the next two years.
These companies that do not provide sufficient security should be burnt to the ground. We could start with every other Home Depot to set an example.