This industry has systematically externalized the cost of these data breaches, and the security systems necessary to try to prevent them, to every other business and end-user in the country.
There are many ways to solve this problem. Europe has largely solved this problem, and using your antiquated American credit card in Europe is not only difficult, but even if possible will elicit crazy looks.
What other industry today would you trust that the only security is a 16 digit number that you repeatedly share with the world and your zip code? And to think this is how we secure our money?
Adobe is offering a service that costs at the least tens of dollars to 38 million people. What is your credit card offering?
The credit card company is offering full fraud protection. So if someone does use your CC for fraud, you're inconvenienced, but not liable. That's far more than what Adobe is required to offer.
I'm quite happy with the American system of "it's the CC provider's responsibility to sort out fraud". It allows commerce to flow, and the backend can figure out fraud most of the time. Putting the burden on a consumer via a PIN system now means consumers have to be more careful, which is bad for consumers and could possibly deter them from using the cards as much.
Edit: The one thing I'd agree on is the broken system of "credit" in the US. Any company can ruin your credit rating based on their own internal policies, and successfully fighting is a major ordeal. All a company has to do for proof is show a bill, which they literally can just make up.
Additionally, requiring an SSN for everything is ridiculous. Cable TV and prepaid T-Mobile even demanded one. In Canada, no company is allowed to refuse service if you decline to provide your SIN.
Source: They just directed me to protectmyid.com and told me to sign up and pay for it myself. Not a great customer service experience.
Wait what does Europe do? Just genuinely curious, and a cursory google search didn't return anything.
Otherwise, offline you place it into a card reader and enter a PIN. The card then authenticates the transaction only if the PIN matches. The card stays within the reader as you enter the PIN.
Further reading,
I can confirm, when I first came to the UK four years ago, only major retailers seemed willing to accept my Canadian CC, and even then, the cashier usually had to call the manager to confirm that it's ok.
Another thing I have to credit Europe with is the lack of proprietary debit card systems like Interac or Plus. It's all done via Visa/Mastercard Debit, so you're never forced to do your online shopping on credit.
However, design involving collaborators, vendors, and professional output often requires standardizing on Adobe software. I'm not happy about it, but it's where the industry currently happens to be. Don't confuse honest pragmatism with some form of stubborn laziness.
It's not so much the breach as it is the lackluster response and lack of ownership of the problem that has me ready to cancel the service. Even the original blog post, which reported only 1/10th of the real information leak, started with: "Cyber attacks are one of the unfortunate realities of doing business today. Given the profile and widespread use of many of our products, Adobe has attracted increasing attention from cyber attackers."
Sure those are valid statements, but they don't really help me feel good about the Adobe platform going forward, and they do more to pass responsibility than to claim ownership.