American Express Warns Customers of Third-Party Data Breach

American Express (Amex) alerted customers that a third-party data breach incident may have compromised their credit card details.

The hacking incident of a merchant processor was explained in a notification letter sent to impacted customers. Submitted under the name, “American Express Travel Related Services Company,” a copy of the letter was also filed with the State of Massachusetts Office of Consumer Affairs and Business Regulation (OCABR).

“We became aware that a third-party service provider engaged by numerous merchants experienced unauthorized access to its system. [..] It is important to note that American Express owned or controlled systems were not compromised by this incident,’’ the notification letter explained.

According to the details shared by the company, card account information of some of the members was exposed, including current or previously issued Amex card account numbers, customer names, and other card details, like expiration date.

It also notified customers about receiving additional Amex issued letters if more than one of their accounts were hacked.

It is currently still unclear about the number of customers impacted by the incident and which merchant processor was hacked.

‘’Please be assured we are vigilantly monitoring your account for fraud and, if it should occur, you are not liable for fraudulent charges on your account,’’ the company reassured impacted customers.

It also advised customers to review their Amex account statements over the next 12 to 24 months for any sign of fraudulent activity. Impacted customers were also advised to enable instant notifications in the Amex Mobile app, to receive alerts of suspected fraudulent transactions.

Over the past several weeks (January & February 2024), American Express has reported several third-party breaches, involving exposure of credit or debit card details to the State of Massachusetts’ OCABR. The 2024 State of Massachusetts’ Data Breach Notification Report revealed.