thanks spin...yeah, I usually make little purchases too so I am going to have to go through all my statements. how far back do you think I should go.

_________________

Capital One seems pretty good about notifying me about suspicious charges - in fact, my experience is that they lean toward being overprotective in notifying me. Thankfully, they did catch some suspicious transactions on my card about a month ago. I actually wonder at this point if I was one of the first people hit, as that was a card I used on the Club site. Then again, I used my new card on the Transformers Club site to get Runabout/Over-Run, and so far it still hasn't been hit. I'm hoping it somehow gets overlooked because it expires in May so I'll be forced to get a new card then anyway and hope to avoid the trouble of updating it on various sites for a third time this year.

In terms of how the Club has handled this, I think that they could have been a lot more upfront and a lot less dismissive of members' concerns. Sadly, this approach is not exclusive to the Club, as TFSource.com basically handled their credit card hacking issue the same way - the owner Curt generally kept quiet about the issue despite mounting evidence in a TFW2005 thread (and possibly threads on other TF sites as well), and he only sent out an e-mail after a lot of pressure. Maybe there is some legal liability they face by even doing something as simple as warning people of a possible issue, but I think most people would have been a lot more sympathetic had been more proactive about informing its membership. Hacking unfortunately happens a lot, and it's simply not possible to protect against every possible attack - just don't try to pretend that nothing is wrong when the evidence strongly suggests otherwise.

As for me, I'll probably still do some business with the Club since I still plan to attend the convention and still would like to get the subscription, but I may end up having to pay by check or by some preloaded Visa gift card. Beyond that, I don't know. I didn't have a huge amount of faith in their security before, and now I have zero confidence in their ability to protect my information. It seems pretty clear from this thread and from other boards that many other people also have lost confidence in the Club, and I can't imagine that is good for the Club's bottom line.

In theory, I'd be supportive of some other group getting the license, even though in general I've been pleased with many of their offerings. In reality, even as low-tech and as small an operation as Fun Publications seems to be, I honestly have no idea what group could do a better job. The Canadian Joe Con organizers are the only group that seems like a remote possibility.

the way the club makes this sound, any card used in the past (that still has the same info) is potentially compromised

_________________

Like my wife said, it sounds like someone in the company got sticky fingers. Either they know who it is, suspect, or just do not know at all. Either way, it's possible to be an inside job and that's a reason they're not coming forward. Trying to protect themselves and for whatever reason, the other person.

_________________

I thought the same thing J-Man.

_________________

Add to the fact that when this started with teh TF club a month ago, Fun pub was very dissmissive to the claims even though there was a ton of info piling up, it wasn't unilt the evidence was literally overwhelming that they acted, which if they had started looking into this when things started could have probably nipped it quickly before the theives had a chance to do more damage. Even after looking into it, the club's communication has been all "Woe is me" while feeling dismissive to the customer's issues as "not a big deal" At essence it's a customer service nightmare and they aren't even trying to fix thier communications to the customers.

Is that really anything new though? They've always seemed that way to me. I get that people are upset about it. They have every right to be. I'm not happy about it myself and I'm certainly watching my account like a hawk to see if anything happens. This never should have happened and I don't think it would have if they didn't have such an antiquated website and store. I just ordered a Runabout from them when they were put up for pre-order so it's a strong possibility that I could be hit too. But I've also been paying attention to what they've shared and they DID give a reason as to why they've been quiet about it and I think J_Man makes a very good point along those lines as well.

If they suspected a breach, they should have shut their systems down immediately.

There is no excuse for not doing so. Continuing to take orders while suspecting a breach is irresponsible to say the least.

_________________

I seriously doubt this is an inside job. This sounds like typical hacker behavior based on the diverse sources of fraudulent charges.

I agree with this. There was a lot of damage done here. Too much for 1 person to do and not get caught. Considering how small the club staff is, they have to be close and seeing what each other are doing. I'm convinced this came from the outside through an exploit on the web services and an unencrypted customer database.

_________________

That is exactly what they did. Plus it was/is the delay for the FSS.
Could it be that whoever they hired to set it up stole the info?
In any case I canceled the card I used there. I bought 2x Dr. Venom sets in December. I had my bank print out my most recent statement & luckily I wasn't hit. I used a debit card too. I don't know how fraud on those would be handled.

Assuming it wasn't an inside job but a hack on an unencrypted database of credit card numbers, the Club is still guilty of totally unacceptable customer identity security practices. They've compounded that issue by handling this in the EXACT wrong way.

What they should have done the moment they realized there was even the possibility that a hacker (or anyone else) saw any of their client info was to contact every person for whom they have information and to do so directly (not via blast e-mail). They should have explained that they discovered a potential security breach and strongly urged each individual to close the card they had on file, even going so far as to tell recipients what kind of card it was and the last four digits of the number.

Keeping it quiet for any period of the time was the worst possible thing they could have done from a liability, credibility and PR standpoint. If they were a better known company, they'd be catching a LOT more heat for this.

did i mention !! MY WIFE IS PISSED !! ?

she said 'enough of this bullsh$t, start fixing this' to me and cancelled the card (which we both have one of)

it is now my task to get all the auto payments transferred.

thanks GIJCC, tell me again how you're 'my' club?

_________________

This


I told my wife that i may have a card issue and she looked very, very angry....but looking at when I got my membership renewed it was 2010. I haven't seen any odd charges from any odd places.

_________________

Your wives think you've been on those pay porn sites and are using GIJCC as an excuse.

We know that's true for joemichaels but I'm sorry for you other guys.

_________________