Wards didn’t tell customers they were hacked
According to the rumbles in the press Montgomery Ward was hit by a breach that exposed account information that included names, addresses, credit card numbers, expire dates and CVV2 data. Reports are sketchy as to when the breach occurred but it was discovered back in December. Wards notified the Secret Service but never bothered to notify their customers.
Dan Clements over at Card Cops started seeing 200,000 cards from the same merchant being offered for sale in carder chat rooms and did some investigating. The cat was out of the bag. When the Associated Press questioned Montgomery Ward’s parent company, Direct Marketing Services, about legal requirements of notifying customers, they started to scramble.
At this point, we don’t know if the 200,000 was in inflated number or if the data breach is larger than reported. I suspect that it might be a combination of both. In any event, Montgomery Ward was storing data that they weren’t supposed to be storing and they failed to notify their customers when it was exposed. The former is a violation of their contracts with the card companies, the latter is a violation of law in 44 states.
Thank you, Direct Marketing Services for being on top of everything related to security of customer data.
Nice job, Dan Clements, for blowing open another one. A gold star from Merchant911!
Similar Posts:
- The Hannaford Data Breach - It’s Unique
- Top Fraud Incidents of 2008
- The 2007 costs are rolling in.
- Telephone Fraud Prevention Service
- The Recent 60 Minutes Report on Fraud
