- Image by victoriabernal via Flickr
California was the first state in the nation to pass a data breach notification law in 2003, and it’s now planning to broaden the notification for companies doing business in the state. Notification will require specific information about the breach to the consumer and send notices to the state authorities at the same time.
The notices which consumers currently receive are basically too little too late, meaning they might say that your information may have been compromised and these notices may be released several months after the incident.
California’s new legislation will force the organization to admit the extent of the compromise, so consumers can assess their own risks in a timely manner. Heartland, the credit card processor, has been sued by the banks to recover the breach notification cost. Should the credit card processing company which had a security breach be responsible for the cost of the notification?
Current notification does not inform you where and how your credit card information was compromised so that at least you can stop shopping from that merchant. When consumers ask specific questions regarding the breach to the credit card company customer service representative, they will deny any knowledge of the breach and will say something along the lines of, when all the legal information has been taken care the credit card company will send you a detailed letter about the breach.
Now in case of a processor security breach, the credit card company might issue notices to several hundred thousand people. Without specifics, that particular notice might have “crying wolf” effect and consumers might not take any action.
Last week a well publicized security breach at UC Berkeley exposed the records of 160,000 people. The hackers had access to the vulnerable system for more than six months before they were discovered, which clearly shows lack of monitoring control and due care.
When a young college student affected by the breach receives a “may have been breached” notice he or she immediately will worry about his/her credit and possibility of identity theft. Now the question is why a student has to bear the burden of the negligence by the merchant or campus and lack of reasonable security safeguards. After issuing such notice that the private information “may have been compromised,” the responsibility of keeping an eye on your credit is transferred to you. The problem is some fraudulent transactions might not be noticed for at least a year.
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=c0f0d90e-bec6-4fb0-8cc1-da10b6d29d91)
May 18th, 2009 2:36 am
[…] Read more: Security breach and notification | DISC InfoSec blog […]
May 18th, 2009 12:53 pm
[…] Read the original: Security breach and notification&#… […]
May 26th, 2009 4:49 pm
Other states definitely need to follow suit here. its ridiculous that company's are not being held more liable for the part they are playing in seeing identity theft becoming the fastest growing crime in US history.
June 29th, 2009 6:40 am
Hi, sorry if I don't stick with the topic, I just want to know where you got this template? Just answer the question below my comment, thanks. And if you tell me then I will suggest my friends to visit this blog because of it's service.