Is the Bottom Line Impacted by Security Breaches?

["Kenneth F. Belva" <ken () ftusecurity com>]

> > In the paper I ask: "If 40 million customer credit card numbers are
> > exposed in a security breach at the credit card processor CardSystems, why
> > do a significant number of people not cancel their Visa and/or
> > Mastercard?"

> Simple .. because Mastercard/Visa got to avoid having to notify their
> customers of the breach :

> http://www.consumeraffairs.com/news04/2005/cardsystems_court.html

> ~Mike.

Mike,

I'm not so sure it's that simple... People were aware of it.

It certainly was all over the press at the time:

http://money.cnn.com/2005/06/17/news/master_card/
http://www.consumeraffairs.com/news04/2005/cardsystems_suit.html

If the US population is 296 million and 40 million cardholders were
affected, that means that 13.51 percent of the population would be
affected (on the assumption that is only US citizens that hold a
Visa/Mastercard).

Not everyone in the US has a Mastercard/Visa so the percentage of those
cardholders affected by the breach is in fact higher. It's hard to keep
that quiet by just not issuing letters to those affected by the breach.

What I wonder about is the applicability of the White and Case study.

When I hear figures of 20%, it really represents a serious financial impact.

One would hear about such loss from publicly traded companies, similar to
the 4% loss in Q2/2005 due to the Wendy's chili case.

Ken
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/