American Express Warns Customers About Breach -- From 2013 (csoonline.com) 32
itwbennett writes: In a notification letter dated March 10, American Express warned cardholders that their account information might've been exposed after a third-party service provider suffered a data breach — in December 2013. The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
Re: (Score:1)
They managed to get the email out before the Milky Way collapses into the massive black hole at its center, so yes, it's timely.
Re: (Score:3)
Do you hear that? (Score:1)
Re: (Score:2)
Re: (Score:2)
There's no indication that American Express themselves were compromised. They can only notify their cardholders once the third-party service provider tells them something happened. My guess is that the service provider didn't know until recently.
Re: (Score:2)
I don't know but what I know for sure: When you deal with them, you are contractually obligated to report any security breaches as soon as you notice them.
Reason for delay (Score:2)
The company says they are monitoring accounts for fraud and advise cardholders to do the same, but they offer no explanation for the delay.
Probably because some of the data from the breach was recently seen on the various black-market sites that sell the information.
AmEx is also a bank (Score:1)
Unlike Visa and Mastercard, who do nothing but process cards and pass all the lending risk to the banks, American Express loans out their own money. They know about a breach and fail to do anything about it, they're the ones eating the bill.
seems obvious (Score:1)
someone forgot to put a cover sheet on the TPS report. ;)
Attorney Advice -- Written to a jury (Score:1)
Big company data breaches these days pretty regularly expect lawsuits to result. While some of them (Amex is probably included) mostly avoid responsibility by including no-class-action and arbitration clauses in their contracts, they are still going to make sure every word of an announcement like this is vetted by their litigation counsel.
That means that explanations that may be used against them in court are not going to be included.
It also means that this announcement is written to consumers, but it is a
"Third-party" seems to be the crux here. (Score:1)
There simply has to be some way that a second party can be paid without without revealing details about the first party. Hopefully somebody is working on a solution to this obvious weakness in secured transactions.
Re: (Score:1)
They who? Governments spinning their wheels going after small fish and ignoring the big ones?
Re: (Score:2)
Re: (Score:1)
The same way they investigated such transactions before there were electronic payments?
Re: (Score:2)
Which is exactly what they are doing with electronic payments... opening a bank account has pretty much always (in my lifetime) required a piece of identification and a proof of address, which triggered a Due Diligence routine (is it a real/legal piece of ID, does it match the information given to us by the customer, is it the same person, ...), questions about the source of the funds once it crossed a certain threshold and regular scans against sanctions lists.
The only major differences are that the lists
I noticed (Score:2)
Re: (Score:1)
(being in Canada, there aren't a lot of places that take it)
What's Canada got to do with it?
Not their fault! (Score:4, Funny)
Th -- they had a flat tire!
They didn't have enough money for cab fare!
Their tux didn't come back from the cleaners!
Some old friend of theirs came in from out of town!
Someone stole their car!
There was an earthquake!
A terrible flood!
Locusts!
Hackers!
IT WASN'T THEIR FAULT, THEY'VE SWORN TO GOD!
"third party service provider" (Score:5, Interesting)
I'm betting AMEX isn't the only card company hit in this, but there are so many data breaches unless you work in credit card ITSEC you probably don't keep good enough track of it all to tie it all together. It could be CK Systems [cksystem.com], they are a CC processor that got hit in 2013.
I received the letter (Score:1)
Amex sent me the letter regarding the breach. After seeing they wanted me to closely watch my account activity for the next 12 to 24 months, I concluded I it was more effort than I was willing to expend. I contacted Amex to get more information regarding the breach. They, understandably, would not / could not offer more information and stated there is an ongoing investigation. After telling the nice lady their recommendations were more than I was willing to do, I asked for a replacement card. It was ei