Tag some tech reporters as well for extra fun.

It might be worth sharing with a journalist; potentially the author of the linked article?

We shouldn't have to depend on publicity and shame to force a company to be careful with our data, we should have a neutral agency that investigates every report equally and is able to hand out fines for those companies that don't take our privacy seriously.

(I mean, California is on the right track)

I've tried escalating this with them multiple times, each time they insist that I won't receive any more emails, until the next one arrives. I also tried threatening them with taking it up with whichever authority is relevant if they don't fix it and reminded them about the 20m Euro or 4% of global turnover fine they could incur, yet still keep receiving this poor saps information.

[1]: https://autoriteitpersoonsgegevens.nl/en/contact-dutch-dpa/c...

[0]: https://www.t-mobile.nl/Global/media/pdf/privacy-statement.p...

> [A bank's] CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone. [...] The legal department (or an analogous group – it is different at every bank) is not scored on cases resolved per week. They are scored on regulatory incidents per quarter, and their target for success is likely zero. Shockingly senior people will be involved to avert regulatory incidents.

src: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

Regardless, it's a very different problem to a bug introduced by the company that leaks customer information.

I think the initial communication is obviously not the fault of the company, but as soon as they are aware and refuse to put right the situation, I think they are very much at fault.

- Full name

- Date of Birth

- Some kind of National ID number

- Bank account details

- Address

If I was of a lesser moral character I'm sure I could have been very naughty with that information.

https://gdpr-info.eu/art-16-gdpr/

The initial issue is probably not a violation of GDPR, and not a reportable data breach. However, not fixing the issue after it was brought to their attention is more likely to be a violation.

The next day I had 6 charges from 2 Fry's in the area of where I was the day before, totalling about $550 at stores I had never been to (and did not appear as instacart charges like they normally would). My bank gave me a fraud warning when they tried to use an atm. I still had the card in my possession. I reported it to Instacart and never got a response. My bank was able to reverse the charges as fraud though, fortunately.

So I don't know how, but at least 1 rogue instacart delivery people was able to get my atm card information and misuse it. If not, the coincidence that accounts for all the evidence is astronomical.

I keep a pre-paid credit card that i will occasionally refill for stuff like this. I keep my actual banking 2-3 steps away from anything online.

All charges go through a credit/charge card (usually amex).

If im particularly skeptical or its a company that requires card info for something that shouldnt (like some intro/free trial) i just use a prepaid card with a minimal amount im willing to lose.

Adorama is a legit store, they've been around for 25+ years.

I've purchased from Adorama in the past without issues and you can call their salespeople for advice, which is unlikely with Amazon.

that service only works because they become the credit card processor and get to pocket the card fee...

If you use Instacart app to order items from Costco the price is actually different. I guess using Costco.com I have my membership benefit.

What is the meaning you are trying to convey here? Genuinely confused by this sentence.

I think "I can care less" is meant to mean "I can care less than most people do, because it doesn't matter to me".

Is this supposed to a be rhetorical question or are you genuinely unable to use Google to discover simple facts?