Acer settles online breach probe for $115k: Difference between revisions

← Older edit Newer edit →

VisualWikitext

@@ Line 11: / Line 11: @@
 According to the customer notice letter submitted to the California Attorney General’s office:<ref>Acer's Notice of Breach to Customers [https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20-%20California_0.pdf? https://oag.ca.gov/system/files/Customer%20Notice%20Letter%20-%20California_0.pdf?]</ref>
-* Notification: Acer sent a formal ''Notice of Data Breach'' to impacted customers, informing them that if they shopped on the Acer e-commerce site between May 12, 2015 and April 28, 2016, their personal and payment information may have been exposed, including name, address, credit card number (with the last digits specified), expiration date, and CVV security code. Acer clarified the hackers did not collect Social Security numbers, and they had no evidence that passwords or login credentials were compromised California DOJ Attorney General. It should be noted that in the settlement with the New York State Attorney General, Acer admitted username and passwords were part of the breach.<ref name=":0" />
+*Notification: Acer sent a formal ''Notice of Data Breach'' to impacted customers, informing them that if they shopped on the Acer e-commerce site between May 12, 2015 and April 28, 2016, their personal and payment information may have been exposed, including name, address, credit card number (with the last digits specified), expiration date, and CVV security code. Acer clarified the hackers did not collect Social Security numbers, and they had no evidence that passwords or login credentials were compromised California DOJ Attorney General. It should be noted that in the settlement with the New York State Attorney General, Acer admitted username and passwords were part of the breach.<ref name=":0" />
-* Remediation Actions: Acer stated that it took immediate steps to remediate the security issue upon discovery and enlisted outside cybersecurity experts to assist, though details on those steps were lacking. It reported the incident to its credit card payment processor and offered full cooperation to federal law enforcement California DOJ Attorney General.
+*Remediation Actions: Acer stated that it took immediate steps to remediate the security issue upon discovery and enlisted outside cybersecurity experts to assist, though details on those steps were lacking. It reported the incident to its credit card payment processor and offered full cooperation to federal law enforcement California DOJ Attorney General.
-* Consumer Guidance Offered: The notice included a Resources Guide advising customers to monitor their account statements, watch for signs of identity theft or fraud, and take proactive steps such as:
+*Consumer Guidance Offered: The notice included a Resources Guide advising customers to monitor their account statements, watch for signs of identity theft or fraud, and take proactive steps such as:
-** Reviewing their free annual credit reports (via annualcreditreport.com),
+**Reviewing their free annual credit reports (via annualcreditreport.com),
-** Filing a police report if they suspect identity theft,
+**Filing a police report if they suspect identity theft,
-** Contacting the Federal Trade Commission or their State Attorney General’s office for assistance,
+**Contacting the Federal Trade Commission or their State Attorney General’s office for assistance,
-** Placing fraud alerts and security freezes with national credit reporting agencies, Equifax, Experian, and Transunion.
+**Placing fraud alerts and security freezes with national credit reporting agencies, Equifax, Experian, and Transunion.
-* Acer offered a toll-free number for customer questions.
+*Acer offered a toll-free number for customer questions.
-=== Settlement with New York State Attorney General ===
+===Settlement with New York State Attorney General===
-In January 2017, Acer reached a settlement with the New York Attorney General’s office, agreeing to pay $115,000 in penalties and adopt a range of security reforms. These included designating employees to oversee data protection, implementing annual staff training, adopting multi-factor authentication, deploying intrusion detection systems, and conducting regular penetration tests and vulnerability assessments. Acer also committed to following credit card industry data security standards and to hold service providers to the same level of compliance.
+In January 2017, Acer reached a settlement with the New York Attorney General’s office, agreeing to pay $115,000 in penalties and adopt a range of security reforms. These included designating employees to oversee data protection, implementing annual staff training, adopting multi-factor authentication, deploying intrusion detection systems, and conducting regular penetration tests and vulnerability assessments. Acer also committed to following credit card industry data security standards and to hold service providers to the same level of compliance.{{Citation needed}}
 ==Consumer response==
@@ Line 29: / Line 29: @@
 On The Register’s forum, reactions were similarly skeptical and critical.<ref>{{Cite web |last=Nichols |first=Shaun |date=2016-06-17 |title=You Acer holes! PC maker leaks payment cards in e-store hack |url=https://www.theregister.com/2016/06/17/what_a_pain_in_the_acer/ |url-status=live |access-date=2025-08-18 |website=The Register}}</ref> Commenters condemned Acer for failing to follow PCI DSS compliance standards and for allowing card verification codes to be compromised.<ref>{{Cite web |last=Pasher |first=Justin |date=2016-06-17 |title=Re: Storing CC security verification codes |url=https://forums.theregister.com/forum/all/2016/06/17/what_a_pain_in_the_acer/ |url-status=live |access-date=2025-08-18 |website=Forum on 'The Register'}}</ref> Some users confirmed they did receive breach notification letters, though experiences varied widely. Many expressed concern that Acer’s negligence would push costs and risks onto consumers through fraudulent charges and credit monitoring needs.
-Consumers faced heightened risks of identity theft and financial fraud due to the exposure of full credit card details, login credentials, and personal addresses. The fact that sensitive data was stored unencrypted in plain text worsened concerns about Acer’s handling of private information. While the settlement imposed stronger protections going forward, many customers were left to deal with potential fraudulent charges, credit monitoring, and long-term distrust in Acer’s ability to safeguard their personal information. Public statements from the Attorney General emphasized consumer expectations for companies to uphold basic data security standards, reflecting broader frustration with corporate negligence in protecting private data.
+Consumers faced heightened risks of identity theft and financial fraud due to the exposure of full credit card details, login credentials, and personal addresses. The fact that sensitive data was stored unencrypted in plain text worsened concerns about Acer’s handling of private information. While the settlement imposed stronger protections going forward, many customers were left to deal with potential fraudulent charges, credit monitoring, and long-term distrust in Acer’s ability to safeguard their personal information. Public statements from the Attorney General emphasized consumer expectations for companies to uphold basic data security standards, reflecting broader frustration with corporate negligence in protecting private data.{{Citation needed}}
 ==References==
 {{reflist}}
 [[Category:Acer]]