Attorneys general: Credit firm hasn’t done enough about lost data
NASHVILLE — The credit card company responsible for the security breach that exposed 40 million cardholders to possible fraud needs to immediately inform those consumers about the risk, attorneys general from around the country said in a letter released Tuesday.
In a terse letter sent to CardSystems Solutions, Inc., the law enforcement officials said the company needs to tell exactly what happened when a computer hacker may have gained access to millions of credit card numbers.
Officials have called it one of the largest security breach involving consumer data. Atlanta-based CardSystems Solutions Inc. processes credit card and other payments for banks and merchants. All brands of credit cards could be affected.
“It is the responsibility of CardSystems Solutions, Inc. to make sure the public is aware of this security breach … and to take the appropriate action to make sure it doesn’t happen again,” said Tennessee Attorney General Paul Summers.
Summers was one of 44 attorneys general signing on to the letter from their national association.
The letter said the company’s action was “unacceptable.”
“We call upon your company to do the responsible thing and notify all affected consumers immediately,” the letter reads.
Company officials in Atlanta and Tucson did not immediately return a call seeking comment.
The attorneys general also said the company needs to:
— Quickly total the number of consumers affected in each state.
— Explain how the breach occurred and the steps taken to mitigate harm to cardholders.
— Disclose its plan to make sure it doesn’t happen again.
“In this era of increasing reliance on technology, it is vitally important that those companies entrusted with nonpublic personal information employ the highest level of security,” the attorneys general wrote. “That’s why this issue has risen to the top of the public policy agenda.”
The attorneys general gave the company until July 25 to respond, and they didn’t rule out the possibility of legal action.
“I think it is doubtful it will come to that,” said Washington assistant attorney general David Huey. “I don’t have any reason to believe we won’t get cooperation from this company. But that remains to be seen, and litigation is the ultimate club.”
Huey said they may find the company was negligent, by perhaps failing to spend as much as it should have on security measures to protect consumer information.
The compromised data at CardSystems Solutions Inc. did not include Social Security numbers — a key piece of information often needed for identity theft. But it had names, banks and account numbers.
“The big fear out there is identity theft,” said Huey. “That is a growing problem, and a huge problem, and one that gives us great concern.”
The disclosure by CardSystems followed other reports of lost data, including lost information for 3.9 million Citigroup Inc. customers, theft of 1.4 million credit card numbers from a DSW Shoe Warehouse database and theft of information on 100,000 Wachovia Corp. and Bank of America Corp. customers.
Credit card holders are liable for no more than $50 of unauthorized charges under federal law. Some credit card companies offer zero liability to customers.
———
On the Net:
National Association of Attorneys General: www.naag.org