Data Commisioner Confirms Credit Card Data Was Not Encrypted

The Irish Times is reporting that the Data Protection Commisioner, Billy Hawkes, has confirmed that the compromised credit card data at LoyaltyBuild had been stored in an unencrypted form – together with the 3-digit CVV number from the backs of the cards.

When first reporting the breach last week, the company had claimed that all financial data was encrypted, and that CVV numbers were not retained.

The Times puts the total number of people affected at about 1.5m: 400,000 whose credit cards have been “seriously compromised”; 150,000 whose cards have been “potentially compromised”; and 1.1 million whose names address and phone numbers were taken.

Related articles

• 500,000 Credit Cards Compromised at Irish Firm
• Supervalu security breach takes sinister twist
• After Security Breach Exposes 2.9 Million Adobe Users, How Safe Is Encrypted Credit Card Data?