PLEASE READ: AeroGrow Inc. Data Breach

I did call AG and they gave me a number to call.  I did that and asked how do we know if we are affected.  While they can not give you that info on the phone, affected customers will get a letter in the mail.  They were mailed on the 4th or 5th.  Letters should arrive but the 15th.

I had already requested new cards before I made the call but wanted to get into the our members.

I had this typed out early this morning but forgot to hit send 

I had 2 cards stolen last month. I knew it was them because one had only been used there. PITA.  

Yeah, there's plenty of blame to go around. A lot of companies aren't doing due diligence when it comes to information security, but I can tell you that even at the ones that are, it's more of a question of when than if. At this point the work is more about minimizing the damage and making sure you'll know ASAP when it happens.

However, I'd put the largest amount of blame on the Payment Card Industry. Visa, MasterCard, Discover and American Express are almost entirely responsible for these problems. Credit cards are inherently insecure by design. There are far better ways to move money around these days, but they don't want to change because it'll threaten their massive revenue stream. Chips on cards could have been better, but when they opted not to do require PINs on chip cards in the U.S. they really cut the security in a big way.

The best systems out there right now are Apple Pay and Google Pay. The way they're doing tokenized transactions is a far better model than just handing out credit cards. I encourage everyone to use them when they're an option.

Sorry for the rant. Information security is my day job and credit cards are one of my biggest gripes.

I got my letter yesterday. They are offering credit monitoring for a year from Experian I think. I had fraud on a card this year but can’t remember if it was the card I used with AG or not.

Ironically I was such a disorganized mess last year that many of my cards were replaced twice. I lost my wallet for I think 3 months at one point- it was in the side pocket of my purse.

I've ordered from AeroGrow a couple times during the affected period, and I did have to cancel my debit card and get a new one after there was a fraudulent charge attempt recently.  This is the only applicable vendor that I use that reported a breach recently so it's the most likely culprit.  Luckily, I'd put security controls on it that prevented the charge from succeeding so I didn't have to deal with having my bank reverse the charge or anything.  When I placed my orders, I wanted to use the Amazon Pay option instead of supplying my debit card number, but the former option was not working on their website so I didn't have any better options.  I do hope they fix their payment mechanisms or offer Paypal because this is why I don't like to expose my card number.