Customers of Colorado bank learn months after JCPenney tried
(2010’s 25 Geekiest 25th Anniversaries)
According to an IDG News Service report, JC Penney attorneys argued in December of last year that, absent evidence of resultant identity theft, disclosing the retail chain’s role as a victim in the Heartland case – two years after the actual breach — “may discourage other victims of cybercrimes to report the criminal activity or cooperate with enforcement officials for fear of the retribution and reputational damage that may arise from a policy of disclosure as espoused by the government in this case.”
U.S. prosecutors stated the obvious in response: “Most people want to know when their credit or debit card numbers have been put at risk, not simply if, and after, they have clearly been stolen.”
The scales of justice eventually tipped in favor of disclosure, but only after a Massachusetts judge undid the bamboozlement that had allowed a New Jersey counterpart to buy into JC Penney’s sorry song and dance.
And should anyone doubt today the wisdom of that corrective decision, they should have a chat with one of 5,000 customers of Colorado’s First National Bank of Durango, who had no idea that they were potential Heartland victims until being notified only March 1 of this year. Actually, as many as 20 of them may have suspected earlier when they started noticing apparently fraudulent charges to their accounts.
I learned of the Colorado bank victims through an item in a newsletter published by DataLossDB and asked one of that organization’s project managers, Kelly Todd, whether it was indicative of there being yet more Heartland time bombs ticking out there; little stashes of card numbers just waiting to be used by your more patient criminals.
Todd’s reply: “Yep, that’s how I read it, too. At least one list subscriber mailed me off-list to ask why people don’t realize that once card numbers or other personal information has been compromised, said information is compromised forever (or at least until the information changes, which won’t happen for SSN, DOB, and 99.999% of the time, a name). A year later and still reporting Heartland-related news? Sure. Card numbers will be out there at least until they get cancelled or expire, and my new cards usually have the same number as the old one, so if they’re in the hands of the bad guys, I’m probably at risk without even knowing it.”
The bottom line here is that corporate interests will first and foremost always be focused on their corporate interests: their own bottom lines. Of course they’d rather not have their good names sullied by association with an identity-theft case of this magnitude. Of course they’ll trot out the lawyers to downplay the exposure to their customers … it’s all part of minimizing their own exposure.
As the U.S. prosecutor noted in opposing JC Penney’s responsibility dodge, most people want to know when their credit or debit card numbers have been put at risk. You can be certain that “most people” here includes the JC Penney lawyers who argued otherwise.
Welcome regulars and passersby. Here are a few more recent Buzzblog items. And, if you’d like to receive Buzzblog via e-mail newsletter, here’s where to sign up.
2010’s 25 Geekiest 25th Anniversaries.
Google cracks animal translation riddle … for Android.
Clever video technique shows there really are two sides to any story.
Doing the Laptop Drive of Shame, Part III
True: This site is not Snopes.com
A new take on cloud security … from Hitler.
Facebook pushing ‘Suicide Machine’ into an open-source afterlife
Cell-phone gabber in fast-food line gets his just deserts
48 technology “firsts” that made a president’s day.
Burglars target wrong techie.
