Yes. They want to make security researchers too afraid to publish their findings.
"Discreetly let us know, at the earliest sign of vulnerability, sign a contract with NDA, and we'll investigate, fix, and compensate you promptly. We'll also publicly acknowledge, in vague terms, for your career development, that you successfully discovered a vulnerability that has been addressed. (But if you intrude beyond the boundaries we've clearly specified, then we don't have a business relationship, and we have appropriate government offices on speed-dial.)"
That's if the company wants NDA. I'm not saying that's how it should be done; just suggesting what seems like a more vendor relationship, business transaction way of being alerted to their own security mess-ups, if that's what they want.
> Nah, let's pay him instead!
is a solution, but obviously can't be the solution. From a distance, white hat "vulnerability disclosures" start to look like a protection racket.
A pretty big distance.
If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket.
If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.
Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...
That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments.
> The more you pay people to find them, the harder they look...
Yeah... that's the point...
Your own staff and vendors are creating security vulnerabilities, and you wisely run a bounty program, to detect and alert you. And you only pay when they find a problem. It can be very economical hedge against both mistakes and systemic dysfunction.
Also, if the researchers were criminally-inclined, they could make more money selling vulnerabilities to someone, not alerting you.
No reports means no vulnerabilities and thus no expenditure.
It's why you'll see a black & white approach to this among bug hunters, instead of a grey / middle-of-the-road one. Some will try to disclose responsibly, the company will deny, and by disclosing through their BBP you've technically agreed to their NDA, so you can't say a word about it even if it still exists a year later. Others will find it and just post it publicly right away, as they don't want to agree to an NDA, and a public action leads to them actually fixing it quickly instead of letting the vuln sit around forever.
Ooh, wait.
Doesn't behavior like this mean that security researchers are more likely to intrude further next time -- at this company and others -- to gather more evidence of impact, expecting the company to lie about it otherwise?
If you want some corporate spokesperson to be able to say "nothing to see here", shouldn't you reward the researcher amply enough that they're fine with the impact being downplayed?
Then kinda going after the researcher in trying to suppress the news, after (AFAICT) the researcher already did the right thing... Does the credit card company have a reason to do that? Or is it more likely some misguided PR staff thinking that's their job? Or some exec ultimately responsible for the infosec mistake, personally not wanting that embarrassment on their watch, and using company resources to try to suppress news of it?