Those who collect and aggregate data have been able to “live in the shadows” for a long time and have gotten by doing less than they should. That’s ending now – the series of almost nightmarish disclosures we’ve seen recently has dramatically focussed attention on the issue and I think the industry is going to shape up fast. And so too will many other businesses who store data. The consequences of not doing enough – particularly adverse publicity – are becoming too serious to ignore.

I think we’ll see a trickle down or meat-in-the-sandwich effect start to occur – at one end, the credit card companies need to limit cardholder liability in order to maintain the viability of the entire system. At the other, merchants are exposed to losses when fraudsters use credit card info to steal goods and services. In between, underneath of the credit card companies, anyone who manages data and exposes it to risk is going to start get sued for the consequences. BJ’s is an example:

http://www.robhyndman.com/2005/06/17/bjs-settles-data-breach-case-with-ftc/

They are getting sued by merchants who lost goods and services because of the data breach. Merchants will start to lose patience with a system that lets the banks and card issuers off the hook and they will start to press them to set higher standards and police them more aggressively. And with the U.S. Congress getting involved in this (this issue is good politics) that will likely happen faster rather than sooner.

But in any event, at the end of the day, there are fundamental problems with the way information technology systems manage security, and this will be a problem for a long time. I’ve really enjoyed reading Bruce Schneier’s books about security for background info on this – particularly “Secrets and Lies”.

I think there is very little the individual can do. Other than restrict use of your card. But in this case, the breach was at a processor – so anyone who used their card at any merchant was potentially at risk. So, no easy answer.

I see you frequent posts about these breaches, but I really don’t know how to use the information to help myself. Can I? It seems so out of my hands.