2 ms·
>It seems like you would have to prove it is gross negligence though. Storing PAN's in clear text is a violation of many, if not all, payment networks, be it d
by AdieuToLogic 7y ago
>It seems like you would have to prove it is gross negligence though.
Storing PAN's in clear text is a violation of many, if not all, payment networks, be it done by a Merchant or any intermediary. The citation I will show below is MasterCard specific, but should not be considered restricted to that network.
> It's not their fault if they lost a database to a 0day or if they were otherwise doing everything reasonably correctly.
Actually, it very well can be. And, in this case, it almost certainly is the Merchant's liability (fault) due to not adhering to security standards. For reference regarding same, see the MasterCard "Security Rules and Procedures" document's "Chapter 10 Account Data Protection Standards and Programs"[0].
0 - https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/SPME-Manual-February-2019.pdf#_OPENTOPIC_TOC_PROCESSING_d94e8528 https://www.mastercard.us/content/dam/mccom/en-us/documents/...