TCM Bank, a subsidiary of ICBA Bancard Inc., notified around 10,000 credit card applicants in the past week that their names, addresses, dates of birth, and Social Security numbers were compromised between March 2017 and the middle of July 2018.

TCM assists approximately 750 community and smaller banks with issuing credit cards to account holders. According to TCM, a website misconfiguration which was managed by a third party vendor exposed the data.

TCM refused to name the third party vendor responsible for managing its website and presumably responsible for the compromise, but stated that the issue was corrected, and it is requiring the vendor to evaluate procedures and technology to ‘detect and prevent similar issues going forward.”

This incident is a reminder of the importance of a vendor management program, including website hosts, and contractual measures in place in the event of a security incident caused by a vendor, subcontractor, or other third party.

[View source.]