kaka

cx dpo acknowledged recipient for email asking for data subject access request with no substance

percysmith

jeweled golf club

1) Do you trust what they tell you tho? Especially when you say they don't know your HKID.
2) Assuming your name was taken too, its not hard to make some half genuine ID for some can't be bothered company to approve their use.
3) Remember how some people got their alipay account breached?

Is anyone doing the class action?

Lussac

I've contacted them for more details on what they intend to do with this lawsuit before committing to anything but they did say they have a large number signed up already.

Cambo

Ambulance chasers, their goal:
- Fill their own wallets by wanting a 30% fee of the CX extorted amount.
- Let all participants deposit a significant amount for whatever plausible reason, to cover their real costs, just in case the extorted amount is less then the costs.

Of course, they will tell you, a lot of people already signed up.

Be aware, to be able to get compensation, you will need to show some kind of damage. The simple fact that info has been (presumed) stolen, does not imply, it is being used malicious. EU-GDPR fines go to the EU, not to the individual.

Put your emotions aside. With "significant" information stolen from 9.4 million people, there should have been a huge crowd, who was a victim of fraud though until now, if fraud was the target of the theft. I did see zero notifications somehow or another related to this leak.

(Which again convinces me, the hackers weren't "commercially" interested, ie state hackers).

percysmith

1) is a legtimate concern, especially since they revealed they've been under continuous attack for 3 months after being towed to Legco.

What else are they hiding? Wonder are there grounds for establishing a Commission of Enquiry (HK-style Royal Commission)?

Cambo

A lot of unclear aspects, though, I think, we should give CX credit for their effort to painstakingly investigate and report at the individual level, which record items were leaked for each individual customer. I do think, most companies would have simply said something general, like, "If you have your HKID stored at CX and used it in this period, it highly likely got leaked.". Have a look at facebook, google, apple, etc.

percysmith

What assurance do I have that the information is complete, and a judge with compelling powers is not going to find the 20-odd credit cards and my mother's alias passport copy has not been leaked as well?

Cambo

That's easy: You don't.

To be (more) sure, you will have to setup your own investigation team & program, convince CX (probably through a court action), to let the team investigate the same as CX already did and find out if CX made mistakes and/or cheated on the whole. I don't think any court will grand you such a request, unless you can make very plausible, CX cheated on you, with what they reported. That'll be difficult, to say the least.

On the practical side, CX gave each individual an exact description of what (which records) has/have been accessed (leaked ?), which does (at least) me, give "quite some" confidence, CX did seriously investigate and deal with this matter.

I just came over some press coverage that the august BA leaked credit cards do seem to be offered at black markets.

Despite the CX leaking being significantly longer ago (and at a significantly smaller credit card scale), I did not see any notices appear about leaked data being available for purchase.

To be able to offer leaked data, the party doing the commercialization, certainly will have to tell their potential customers, where the data comes from, otherwise their customers have no idea about the value of what they can buy.

(Which again does let me expect this leak to be from state hackers. I think, it's an excellent idea to, as a state intelligence institute, hack major airlines to obtain information about people vs. their communication methods, as well as people movements around the globe. Not that many other organizations will have such a high quality info about everybody travelling around the globe. Not even banks have that info.)

percysmith

I have my suspicions BA leaked my card info - I just had the USD card I use for BAEC (which I use for USD transactions only) fraudulently charged overnight, cancelled and replaced first thing this morning.

However, the company that admitted they have not told us everything at first is worse than the company I can't prove has not told us everytthing.

jeweled golf club

I agree. Surely it can be a big problem, otherwise FB wouldn't have gotten a big fine over it in Europe.

Just like EC261, not being consumer friendly is an annoyance by itself.

txflyer77

Has anyone seen which security firm CX has hired for the investigation?

Sometimes that's the best indicator of which sort of attacker is at play.

blum81

So has anyone signed up for the class action lawsuit?

kathkiwi

Sadly my first comment on FT is to advise that CX told me only my name and title had been hacked. But last week, my credit card was hacked with ~$3,000 NZD for flights, including one on Cathay. Quite scary. Thanks for all the info here.

Cambo

Unless you did not use your card for a long time anywhere, the physical card is stored safe and you never "stored" the card details in such a "secure" clode safe, it would be a very long jump to suggest your card details became compromised through the CX hack&leak.