3 ms·

Fining a company for gross negligence of assets they are entrusted with seems like a fair path to explore for starters.

• umvi 7y ago
  It seems like you would have to prove it is gross negligence though. It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly.
  • ziddoap 7y ago
    Well... Yes. That is how it usually works. You prove gross negligence, they pay a fine. They prove that they were doing everything reasonably in their power, they don't pay a fine.
  • AdieuToLogic 7y ago
    >It seems like you would have to prove it is gross negligence though. Storing PAN's in clear text is a violation of many, if not all, payment networks, be it done by a Merchant or any intermediary. The citation I will show below is MasterCard specific, but should not be considered restricted to that network. > It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly. Actually, it very well can be. And, in this case, it almost certainly is the Merchant's liability (fault) due to not adhering to security standards. For reference regarding same, see the MasterCard "Security Rules and Procedures" document's "Chapter 10 Account Data Protection Standards and Programs"[0]. 0 - https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/SPME-Manual-February-2019.pdf#_OPENTOPIC_TOC_PROCESSING_d94e8528 https://www.mastercard.us/content/dam/mccom/en-us/documents/...