full-disclosure - Is the Bottom Line Impacted by Security Breaches?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu Sep 29 02:43:36 2005
From: ken at ftusecurity.com (Kenneth F. Belva)
Subject: Is the Bottom Line Impacted by Security Breaches?

>> In the paper I ask: "If 40 million customer credit card numbers are
>> exposed in a security breach at the credit card processor CardSystems, why
>> do a significant number of people not cancel their Visa and/or
>> Mastercard?"

>Simple .. because Mastercard/Visa got to avoid having to notify their
>customers of the breach :

>http://www.consumeraffairs.com/news04/2005/cardsystems_court.html

>~Mike.

Mike,

I'm not so sure it's that simple... People were aware of it.

It certainly was all over the press at the time:

http://money.cnn.com/2005/06/17/news/master_card/
http://www.consumeraffairs.com/news04/2005/cardsystems_suit.html

If the US population is 296 million and 40 million cardholders were
affected, that means that 13.51 percent of the population would be
affected (on the assumption that is only US citizens that hold a
Visa/Mastercard).

Not everyone in the US has a Mastercard/Visa so the percentage of those
cardholders affected by the breach is in fact higher. It's hard to keep
that quiet by just not issuing letters to those affected by the breach.

What I wonder about is the applicability of the White and Case study.

When I hear figures of 20%, it really represents a serious financial impact.

One would hear about such loss from publicly traded companies, similar to
the 4% loss in Q2/2005 due to the Wendy's chili case.

Ken