Hacker News Reader

Comment by snarfy | Hacker News Reader

> The Home Depot is offering free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store in 2014, from April on.

This is absolutely not acceptable, and I deplore how this has become the status quo. I reject these services and want nothing less than a full lawsuit.

View on HN

I wonder if I can add this year of identity protection services on to the year I got from the Target breach not to long ago. At the rate these companies are losing my credit card number I'll have free identity theft protection services for life!

A lawsuit which you would lose. Especially considering you most likely suffered no damages.

I'm pretty sure the card processors would be on my side of the lawsuit, along with a few million other home depot customers.

I don't care about damages to me. I want the problem fixed. This Laissez-faire attitude towards online commerce security needs to end. Standards like PCI and PA-DSS are not enough. Corporations need to be liable for leaking everyone's information. A year of free credit monitoring is a slap in the face.

Card processors might have a case, but the customers really mostly wouldn't.

The PAN that belongs to your credit card company that was assigned to you by your credit card company was compromised and someone tried to defraud your credit card company using it. Yet it's you complaining, why?

I've been screwed by identity theft before.

Sure, but the only real solution would be not accepting cards. Does that sound like a good solution to you?

Not sure you are being productive.

Not sure about that either, but trying to blame Home Depot for fundamental flaws of the system isn't productive either. You should blame the card design for allowing this, not the people that accept cards.

While the card design could be better, those that accept them have a responsibility. The bigger you are and the more cavalier with card data, the more likely you will get targeted. I have yet to see one of these data breaches where the victim (if we call it that) company was doing a very good OpSec job.

You both have a point, but lean towards more punishment. This isn't something that should just be 'charged' away.

This isn't how the legal system works. You can't proceed with a lawsuit without some kind of defined damages. Unless you can point to something bad that has happened to you, how can Home Depot argue in their defense? How can a jury judge their defense? How can a fair penalty be agreed upon?

Possibly having your data leaked isn't enough of a harm for the courts to hear the lawsuit. If you can force a company to respond to a lawsuit based on the potential that they lost your data, what stops larger companies from suing smaller competitors constantly forcing them to prove they haven't leaked any data? They always could have leaked data.

No damages?

- Go through your entire credit history over a six month period looking for illegitimate charges. (Many people, such as myself, use a single credit card for most of their payments -- that's thousands of transactions.)

- Wait a week for a new credit card to arrive in the mail, and hope none of your automatic payments try to charge the old card while you wait for the new one.

- Update all of your automatic payments. Doing it once would be one thing, but every time one these breaches happens?

None of these are the end of the world, but they're certainly not "no damages".

You'd have a really hard time arguing those as damages in court. And then you'd have an even harder time arguing that it was in fact Home Depot that was responsible.

Typically the financial institute is responsible for any fraudulent charges on their customers' credit cards. The cardholders of the affected cards would probably have a hard time justifying that they were negatively affected by the breach.

Reply on news.ycombinator.com