Hot answers tagged

10

I assume you are talking about customers of the bank not being required to change their password every 90 days. Customers of the bank are not covered by PCI; PCI dictates what employees and others working on the infrastructure within PCI scope are required to do. To quote PCI DSS 3.2.1 Requirement 8 (emphasis mine): Note: These requirements are applicable ...


1

As the linked article states, is appears the server farm was compromised rather than encryption being broken: They eventually discovered that EncroChat was operating from servers based in France and were eventually able "to put a technical device in place" which allowed them to access the encrypted messages sent over the company's network. ...


Only top voted, non community-wiki answers of a minimum length are eligible