AmEx, Discover forced to replace cards over security breach
American Express and Discover Financial Services are replacing credit cards of customers who have shopped at CD Universe, following a security breach at the online music store that exposed some 350,000 customer card numbers.
The moves by American Express and Discover come during a time of heightened concern about online privacy and security issues, spawned by a series of site break-ins and lawsuits in last few months. Privacy advocates and consumers also have been urging the federal government to regulate what online companies can do with users' personal data.
Last week, American Express began replacing the credit cards of every CD Universe customer who used an American Express card at the Web store, according to American Express spokeswoman Molly Faust. Faust declined to say how many credit cards will be recalled.
"The security of our card members is important to us," she said. "We took what we think is an appropriate action and are replacing the cards."
Earlier this month, a hacker by the name of "Maxus" contacted CD Universe, claiming that he had tapped into its customer database, and demanded $100,000 from the company. When CD Universe refused, Maxus posted access to the database on a Web site known only by its IP address. The FBI subsequently shut down the Web site and is investigating the extortion attempt.
Faust said she did not know whether any fraudulent charges had been made as a result of the CD Universe security breach. American Express does not hold its cardholders liable for fraudulent purchases made online.
Discover has reissued more than 10,000 credit cards to its members who shopped using their card at CD Universe, said company spokeswoman Cathy Edwards, adding that it is the only time she remembers the company recalling its cards. Edwards said she did not know if any fraudulent charges had been made with Discover cards as a result of the breach.
"Our security team thought it was appropriate to reissue the cards as a preventive measure," Edwards said.
American Express cardholders were still able to use their old cards until they received their new ones, Faust said. However, Discover's card were immediately unusable after the company notified its members that it would be replacing their cards, Edwards said. Cardholders must wait until they receive their new card to resume charging items to Discover.
Customers could wait up to a week to receive their new cards from either company, although both companies said they can send the cards via overnight delivery to customers that need a new card immediately.