Yawn.....Another multi-million dollar data breach

[mbpark]

Bruce,

I think both, with an emphasis on lazy IT people, because systems like this are very hard to set up, and are why InfoSec people make a lot of money.

You just don't cut the budgets for this unless you're very stupid. It makes no sense.

Then again, knowing some of the middle managers I deal with in IT, nothing they do makes sense to anyone but themselves.

Mitch

Originally Posted by xoxoxoBruce

Mitch, do you have a feeling for whether this Heartland fuck up was lazy IT people, or management cutting IT to the bone for the bottom line?

[richlevy]

Originally Posted by mbpark

Then again, knowing some of the middle managers I deal with in IT, nothing they do makes sense to anyone but themselves.

The funny thing is that this is 2 years after the TJX computer intrusion, which cost that company 256 million dollars!! So with all of that history, and considering that, unlike TJX, their entire company is built around computer data, one would think that they would be hyper-secure.

Well, it appears that there is significant progress in the Heartland case. The company has created a website to inform the public. Note the use of the word unencrypted. They are not saying that PIN numbers weren't taken, just that if they were they were encrypted.

I am so glad that California and then Congress passed a law requiring notification in cases like this. Does anyone want to bet on whether TJX and Heartland would have announced the breach if they weren't forced to by law?

No confidential merchant data, Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers were retrieved in what is believed to be a global cyber-fraud operation. Heartland does not yet know how many card numbers were obtained. Many reports in the press are speculative.

Consumers will know if their card account numbers have been used by reviewing their monthly statements. Cardholders should report suspicious activity to their issuing banks (the bank that issued the card, not the card brand). If unauthorized use is confirmed, cardholders are reimbursed for the fraudulent purchases and are not held financially responsible.

[classicman]

My card was not replaced. I was not notified of any breach or possible breach. Additionally, when I called there was no admission by them either.

[tw]

Originally Posted by classicman

My card was not replaced. I was not notified of any breach or possible breach. Additionally, when I called there was no admission by them either.

I don't see the necessary statement, "The security of my card was breeched". Without that fact, the entire post is meaningless. How do you know a security breech of your card even existed?

[xoxoxoBruce]

Originally Posted by xoxoxoBruce

Mine hasn't been replaced.

Originally Posted by tw

I don't see the necessary statement, "The security of my card was breeched". Without that fact, the entire post is meaningless. How do you know a security breech of your card even existed?

So I suppose mine is meaningless also? And Wolf's was meaning less because she was only speculating hers was replaced because of the security breech?

[tw]

Originally Posted by xoxoxoBruce

And Wolf's was meaning less because she was only speculating hers was replaced because of the security breech?

Classicman said his card was not replaced. Completely different from wolf whose card was replaced.

Wolf said a card was replaced due to a security breech. classicman suggested his card was not replaced due to no security breech. classicman is invited correct his post to make it relevant. For example, he could add the missing sentence "My card security was breeched". Obviously his post is currently ambiguous.

[xoxoxoBruce]

No, Wolf said her card was replace and she SUSPECTED is was because of the publicized security breach, but they wouldn't confirm it.

I said my card was not replaced after the publicized security breach.

Classic said his card was not replaced and although they wouldn't confirm whether his card was breached or not, he was assuming it wasn't because it was not replaced.

If you didn't tail post you would have know that.

[classicman]

1) Posted here was an apparent breach at a bank where I have a card.
2) Individual posted that their card was replaced.
3) I questioned the bank whether the apparent breach included me and why my card was not replaced.
4) Another poster jumped to conclusion due to a personal inability to comprehend and again attacked the poster not the post.

[TheMercenary]

Uggg. I wonder how an individual will ever know if they have had their data compromised until some damaging event occurs?

[TheMercenary]

Come to think of it we did get new Visa cards with new numbers, I wondered why, we have had the same number for many years. But our replacement coincided with the regular exploration dates. Maybe they are just going to do the replacement numbers as normal exploration dates come around. Maybe not to cause so much alarm or raise a flag.