Why am I finding out about this from the news and not an email from Capital One themselves? I wish there was legal liability to inform customers in the event of a data breach.
They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.
According to the Daily Mail article linked above, they've known since mid-July. They could have issued a statement today if they wanted to. I can understand why they didn't do it earlier, to minimize the number of press cycles with their name attached to this incident.
But if this were my credit card company, I would be pretty irked to be finding out about it weeks after the company knew, from the news.
If this is the case, they should have had an announcement ready to go for yesterday. The absence of a response makes it seem like either they’re not taking the incident seriously enough, or they still don’t know the full scope and want to delay their announcement until then.
