Yesterday I received a letter in the mail from Adhost. They are a web hosting company in Seattle which I used to host my server at their facilities a few years ago.
I always had a pretty good experience with them. They are not a big shot hosting company, they were personal, provided a good service at a good price. I had to leave them for another hosting closer to my office in Redmond because going to Seattle every time I need to install a new server or do a hardware upgrade was a hassle.
So, in 2005 I left them.
The letter on the mail was long and explained that their customer database had been compromised by a hacker and they couldn't clearly figure out what was stolen, but to be on the safe side I should keep an eye on transactions on my credit card.
First of all, I commend them for being so upfront about it and quick at communicating it to customers.
But then I ask myself: I have not done any business with them for the past 2 years. Why they keep my information on their customers database and why the heck they keep my credit card number as well?
The answer is simple: most companies have a hard time letting it go of former customers. They want to make it easy for you to come back so they keep your account information active. They want to make it super easy for you to "buy" whatever they are offering, so they keep your credit card on record as well.
I think we would be safer if, voluntarily or by law, every business would erase your credit card / billing information after 18-24 months without any activity.
Now, for taxes purposes, some of that information cannot be permanently erased (only after 7 years), but they could definitely go "off-line" into some encrypted tape-backup at some accountants office, making it that much harder to steal.