Yahoo Triples Estimate of Breached Accounts to 3B

Re:Yahoo Triples Estimate of Breached Accounts to 3B by koheripbal on Wednesday October 04, 2017 @10:55AM (#15400882)

For PCI Compliance purposes, at least, holding user credit card information is already seen as a liability because maintaining compliance is a cost center. That's why there's been some shift towards tokenizing transactions on the fly and directly submitting to the CC company via javascript so that shopping websites never see your CC number even when you enter it on their website - even if you're scheduling future payments.

Maybe we should include other data elements under PCI or similar regulations. SSN?

I imagine HIPAA has similar requirements and associated costs.

[ Parent | on HN ]

Re:Yahoo Triples Estimate of Breached Accounts to 3B by bparsons on Friday October 06, 2017 @09:41AM (#15416687)

Even just a fragment of someone's personal information can be combined with other data points in order to commit identity theft.

Other impacts may not have direct monetary damages, but could be even more devastating (ie Ashley Madison).

Until the courts start clamping down on negligent handling of personal data, firms will continue to cheap out on infosec.

[ Parent | on HN ]