3 ms·
How does PCI compliance not cover these things? Is Target liable for losses here? It would seem to me that if you can't secure the data, you shouldn't keep it
by tibbon 13y ago
How does PCI compliance not cover these things? Is Target liable for losses here?
It would seem to me that if you can't secure the data, you shouldn't keep it (which is the reason I use stuff like Stripe . I don't want to see the card number).
- crawdog 13y agoPCI compliance is supposed to cover this. The fines will be in the millions if it is in fact a PCI violation - using TJ Maxx as a precedent.
- jcrawfordor 13y agoFrom an outside perspective it very much looks like data was acquired off the wire as it was sent for authorization. The data captured included a number of things that the retailer would not be storing at all.
- tibbon 13y agoThat would indicate that either strong encryption has been cracked, there was something on the inside of their datacenter for processing, or they weren't using encryption right?