The Amex Partner Data Breach and Downstream Liability | UpGuard

In March 2016 American Express disclosed that a three-year-old breach at a partner merchant—not Amex systems—may have exposed some cardholder account information (numbers, names, expiration dates); Amex notified affected customers, clarified an incorrect filing with the California Attorney General, and stated customers won't be held liable while critical details about the merchant and breach scope remain undisclosed.