To which entity merchants must report credit card breach?

Question

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response Manager.

Here, it says: There may be circumstances where notification to individual by a third party is more appropriate. For example, in the event of a breach by a retail merchant of credit card information, the credit card issuer may be involved in providing the notice since the merchant may not have the necessary contact information.

Besides notifying the bank and credit card issuer, who the merchants must notify in the event of credit card data breach? Should they send notice directly to individuals?

Answer 1

As per the DSS, the merchant is required to notify the card brands:

12.10.1.a Verify that the incident response plan includes:

• Roles, responsibilities, and communication strategies in the event of a compromise including notification of the payment brands, at a minimum

And the DSS recognizes that other notification requirements may be compelling (e.g., each merchant is subject to whatever notification laws apply to their jurisdiction):

• Analysis of legal requirements for reporting compromises (for example, California Bill 1386, which requires notification of affected consumers in the event of an actual or suspected compromise for any business with California residents in their database)

Needless to say, the jurisdiction question is a problem, given the viral nature of the more progressive state's laws, and the widespread customer base of many web merchants (including international, as your link suggests).

So: the merchant must notify the card brands, which in practice means they will notify their acquirer/processor and it will chain from there. As to individuals? DSS recognizes that may be necessary, but doesn't compel it. Whether it makes sense for a merchant to notify individuals is a question that their public relations and legal teams usually tackle together.

Answer 2

I would say it depends. 12.10.1.a says that there should be a incident response plan, and that it should contain at a minimum contain Communication strategies in the event of a compromise. They dont say you need "at minimum to tell the payments brands", they say you need as minimum to "tell someone", you cant simply have a incident response plan that basically consist of "tidying up" and "securing the compromise" without notifying anyone.

If you decide to communicate to the indivual or to the aquirer, depends on the scale of the compromise. Lets say a untrustworthy cash clerk photographs a single card in the POS with a camera while handling it for a customer and this go on unnoticed by the customer. Lets say this are brougt out to attention.

Then its a lot whole easier, to just notify that affected indivual by phone, and ask him to suspend his card and order a new card from his issuer, than to notify VISA/MasterCard/aquirer of that small compromise. It can be a good deal to notify the aquirer and say that the customer has been notified anyways. This will keep you off the loop in case the customer plays dumb and says he hasn't got any notification and decide not to suspend the compromised card.

If however, a CC database or whatever leaks out, or a website is hacked and replaced with a phishing site, its a really basically a must to notify the aquirer, since, hundreds, tousands or millions of customers might be affected.

The intention of 12.10.1.a is that all affected indivuals should get information about what happened. If you decide to itself inform all your customers, or if you go through your aquirer, is up to you. In most cases, its easier to inform your aquirer.