Comment by joekrill | Hacker News Reader

Comment by joekrill | Hacker News Reader

The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says:

> No bank account numbers or Social Security numbers were compromised, other than:

Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" - which is the primary reason folks are worried about this!

To me, the first thing you are going to see is "No bank account numbers or Social Security numbers were compromised" in bold letters. Which is completely false and misleading. Technically they are telling the truth, but the way they've done it is clearly meant to be misleading.

On top of that, I'm a Capital One customer myself, and I can't figure out how to find out if I was affected at all!

[1] https://www.capitalone.com/facts2019/

And in a non bulleted sentence below that it notes that 1 million Canadians social insurance numbers were also compromised.

But the those 140k and 80k number are their own bullet points that I feel make them stand out more then the bold line. I feel like this is clear enough.

But directly below, on a non bullet-pointed line, they mention that one million Canadian social insurance numbers were compromised..

This is obviously anecdotal, but that was not my personal experience. I was getting ready to go to bed last night when I saw this and grabbed my tablet to see if I needed to worry. This bolded bit was the first thing I saw, and I immediately thought "hm, must have been over-exaggerated, no SSNs were exposed". Now I obviously read on and saw the bullet point, but for someone skimming this, it's not at all obvious.

But further, why even word it that way? It was clearly done intentionally. There's no need for this to be presented in this way other than to intentionally try to mislead. Why not just say, in bold letters "140,000 social security numbers and 80,000 bank account numbers were compromised". Or say it "The following were compromised".

I'm not sure I agree. The ", other than:" portion was also bolded, and the line

> We will notify affected individuals through a variety of channels.

Gives me some confidence the very small subset of individuals who should be worried about those much more exploitable leaks will be informed and offered assistance.

But as another Capital One customer I'm quite irked I can't just query a simple page to find out what data of mine was leaked, if any.

Reply on news.ycombinator.com