American Express customers exposed to non-compliance by third parties
American Express customers are notified that their account information may have been exposed after a third party suffered a data breach.
The world-renowned bank holding company disclosed the incident in a data breach notice filed with the state of Massachusetts this week.
“We became aware that a third-party service provider engaged by numerous merchants experienced unauthorized access to their system,” the notice said.
“It is possible that the account information of some of our cardholders, including some of their account information, may have been involved.”
According to the notice, data affected in the incident includes current and previous American Express card account numbers, names, and other card information such as expiration dates.
American Express has said that in response to the breach, it is carefully monitoring accounts for cases of fraud, and in cases where fraudulent purchases are made, American Express said customers are “not responsible.”
The financial services company also highlighted that its own systems were not breached, but that the systems of a third-party merchant frequently used by the company’s travel services division suffered an instance of unauthorized access.
“It is important to note that systems owned or controlled by American Express were not compromised by this incident, and we are providing this notice as a precaution,” the company added.
The affected third party has not been disclosed and it is currently unknown how many American Express customers have been exposed as a result of the breach.
American Express has advised those who believe they are affected to review their accounts for fraudulent transactions and activity over the next 12 to 24 months and enable notifications from the American Express mobile app. It has also suggested that those who witness fraudulent transactions or suspect data theft apply for a new card number.
