The Comenity Outage Idle Speculation Thread

[Flashman]

 

Yes!  This is your chance to take a guess at what happened, why it happened, and whether this interesting and intriguing event is unique or not. 

 

We are doing this for fun, there is nothing at stake, and your guess is as good as mine (it is likely to be a good deal better, in fact), so have a go at answering these three questions:

 

 

1) Has there been a comparable outage (i.e. comparable in length) by any other card issuer within recent memory?

 

2) What is your guess as to what caused it?

 

and finally:

 

 

3) Are there any rumours flying about concerning the actual cause of the outage versus the stated cause of the outage?  I ask because I do not believe the latter for a moment.

 

I will start things off:

 

1) No idea.

 

2) Ransomware attack.  Comenity first spent some time attempting to find the miscreants, could not do it, and eventually decided to pay up.

 

3) I am afraid I have been too busy lately studiously avoiding ending up on the street to pay much attention to the word on the street (sorry).

 

 

Right, your go...

 

 

 

 

 

Edited July 1, 2022 by Flashman

[centex]

Quite honestly, I believe we can rule out a ransomware attack because BFH would have had to report that given that they are a publicly traded company. 

 

I know there have been a few banks that have botched some software upgrades...but they tended to not have the footprint across as much of the market as the Comenity portfolio.  None impacted my payments since I try to pay earlier than a due date even when paying the monthly purchases in full...the last issue I recall was actually app related, with the website functioning normally.  Do not recall the bank though...

[centex]

https://www.americanbanker.com/payments/news/why-glitches-like-breads-payment-outage-are-riskier-now

 

The log-in requirement or guest account requirements can be disabled by disabling javascript...

[hdporter]

Enjoy the thread ... I'm sticking to filing a stubborn callous on my right heel.

[centex]

24 minutes ago, hdporter said:

Enjoy the thread ... I'm sticking to filing a stubborn callous on my right heel.

well...dang...that is a fairly callous approach to matters...

 

/ducks and runs

[hegemony]

immediate disclosure of any ransomware is a matter for comenitity's regulators not its customers or investors. If it is ransomware there is a good chance comenitity has no clue what the situation is with its extant data and is merely rebuilding data infrastructure from the most recent back-ups.

 

I do like @StarkRaven$'s new bird handle: https://twitter.com/dontaskcomenity

Edited July 1, 2022 by hegemony

[hegemony]

Bread Financial credit card company wrestles with system outage

[StarkRaven$]

2 hours ago, hegemony said:

immediate disclosure of any ransomware is a matter for comenitity's regulators not its customers or investors. If it is ransomware there is a good chance comenitity has no clue what the situation is with its extant data and is merely rebuilding data infrastructure from the most recent back-ups.

 

I do like @StarkRaven$'s new bird handle: https://twitter.com/dontaskcomenity

Great article you posted Hege. Thanks for that. Wish I could take credit for the handle but I don't do Twitter.

[Flashman]

On 7/1/2022 at 12:13 PM, centex said:

Quite honestly, I believe we can rule out a ransomware attack because BFH would have had to report that given that they are a publicly traded company. 

 

Yes, as you rightly point out, they are required to report such security breaches.  However, I am less clear on the prescribed timeframe within which such reporting must take place.

 

For example, the Cap One data breach was discovered July 29, 2019, yet was not announced to the public until 10 days later.  I would guess Bad Guys can do a fair bit with your personal information in 10 days, so it would seem that the legislation that governs such things tends to favour the credit industry rather than the shareholders and consumers it is ostensibly designed to protect.

 

Of course, that was three years ago, and the reporting requirements may have changed since then.  Nonetheless, it would be interesting to learn just how much leeway credit firms have when it comes to reporting security problems.

 

 

 

 

 

 

[hdporter]

On 7/1/2022 at 6:31 PM, hegemony said:

Bread Financial credit card company wrestles with system outage

 

I guess that I'm impressed that all parties quoted in this article appear to have their heads screwed on right. 

 

(Contrast that to the recent article in which a MA couple were quoted, without challenge, as saying that the wife's Macy's app was rejected because her husband's Home Depot app was rejected for an incorrect SSN ... or something like that.)

 

It's comforting that there's at least one consumer finance reporter out there who can put out a clean story ...

[StarkRaven$]

3 hours ago, hdporter said:

 

I guess that I'm impressed that all parties quoted in this article appear to have their heads screwed on right. 

 

(Contrast that to the recent article in which a MA couple were quoted, without challenge, as saying that the wife's Macy's app was rejected because her husband's Home Depot app was rejected for an incorrect SSN ... or something like that.)

 

It's comforting that there's at least one consumer finance reporter out there who can put out a clean story ...

Yes the article was spot on.

[hegemony]

back up?

[TheVig]

3 hours ago, hegemony said:

back up?

 

I've been able to login without issue since Saturday.

[TheVig]

A payment I pushed to my BJ's MC has posted on-time without issue. 

[parrothead1]

I had to call the number posted on the website to pay my old wayfair card.  I still can't get on. 

[RehabbingANDBlabbing]

So the website for my Ulta credit card has been working fine since they sent the email acknowledging the issue and saying it was back up and running.

 

I have been trying to use the CLI button, but I am not sure if it is working. It asks for my income and I hit submit, but then nothing happens. It acts like I updated my income, versus submitting a CLI request. Is this part of the glitches or is what they do when you are getting a denial? I haven't gotten any digital or physical notifications that my CLI request was denied.

[StarkRaven$]

3 hours ago, RehabbingANDBlabbing said:

So the website for my Ulta credit card has been working fine since they sent the email acknowledging the issue and saying it was back up and running.

 

I have been trying to use the CLI button, but I am not sure if it is working. It asks for my income and I hit submit, but then nothing happens. It acts like I updated my income, versus submitting a CLI request. Is this part of the glitches or is what they do when you are getting a denial? I haven't gotten any digital or physical notifications that my CLI request was denied.

Probably. Personally, I wouldn't want a CLI from them. I'd close my card but it's my oldest cc.

[snookums]

     I actually came to credit boards just now to see if this was being discussed. I have a Wayfair card from Comenity that I can't access to pay. I was able to pay last month. I called and the lady told me that it was an outage that would be resolved. A few days later, tried again, it still says my account is closed. So I did some googling and found an article dated July 1 regarding the outage. It's now July 23. 

     I can't pay via Easy Pay because I can't find the card number!! I think I shredded it at some point because I could no longer use it once Wayfair stopped using Comenity and shut the credit line. I only know the last 4 because it's in the emails they send me. And the lady wouldn't give the full card number to me over the phone (like why not? It's not like purchases can be made with it anymore). I don't remember an option to pay over the phone, but I will call back and try that again. 

     I tried to use the secure message feature on their page but it wanted me to log in to do that, and once I did, it again said the account was closed. Absolutely crazy that an outage can go on for this long at a financial institution. 

     So frustrating. 

[parrothead1]

3 hours ago, snookums said:

     I actually came to credit boards just now to see if this was being discussed. I have a Wayfair card from Comenity that I can't access to pay. I was able to pay last month. I called and the lady told me that it was an outage that would be resolved. A few days later, tried again, it still says my account is closed. So I did some googling and found an article dated July 1 regarding the outage. It's now July 23. 

     I can't pay via Easy Pay because I can't find the card number!! I think I shredded it at some point because I could no longer use it once Wayfair stopped using Comenity and shut the credit line. I only know the last 4 because it's in the emails they send me. And the lady wouldn't give the full card number to me over the phone (like why not? It's not like purchases can be made with it anymore). I don't remember an option to pay over the phone, but I will call back and try that again. 

     I tried to use the secure message feature on their page but it wanted me to log in to do that, and once I did, it again said the account was closed. Absolutely crazy that an outage can go on for this long at a financial institution. 

     So frustrating. 

There is a phone option. I used it about 10 days ago to pay my Wayfair card.  I did not have to have my card number. I think I followed the link in my payment reminder email. 

 

Just had a thought, call them and ask for a paper statement to be sent to the address they have on file for your account.  Or go old school and send them a check with your name, last 4 and the amount due. 

Edited July 23, 2022 by parrothead1

[StarkRaven$]

3 hours ago, snookums said:

     I actually came to credit boards just now to see if this was being discussed. I have a Wayfair card from Comenity that I can't access to pay. I was able to pay last month. I called and the lady told me that it was an outage that would be resolved. A few days later, tried again, it still says my account is closed. So I did some googling and found an article dated July 1 regarding the outage. It's now July 23. 

     I can't pay via Easy Pay because I can't find the card number!! I think I shredded it at some point because I could no longer use it once Wayfair stopped using Comenity and shut the credit line. I only know the last 4 because it's in the emails they send me. And the lady wouldn't give the full card number to me over the phone (like why not? It's not like purchases can be made with it anymore). I don't remember an option to pay over the phone, but I will call back and try that again. 

     I tried to use the secure message feature on their page but it wanted me to log in to do that, and once I did, it again said the account was closed. Absolutely crazy that an outage can go on for this long at a financial institution. 

     So frustrating. 

I know exactly how you feel. Actually I had a similar problem just trying to pay my water bill online. Their phone contact numbers weren't working either. I actually called the emergency number and the lady told me they were doing an upgrade online and that's why I couldn't log in. Online it would not accept my user name and password and it wanted my account number to reset it. I didn't have the account number because I went to online payments years ago. Just a little while ago I could finally access the website with the same existing user name and password and I paid my bill. I am adding all account numbers to my list of passwords for future reference.

[hdporter]

12 hours ago, StarkRaven$ said:

I am adding all account numbers to my list of passwords for future reference.

 

Off topic:  Time to get yourself a secure password manager.  I use Roboform and it also keeps track of account details:  Issuer, link, login/password, account number, exp, CVV, cust svc number, etc. (incl CL).  You can even add notes as reminders of such things as late credit limit increase date.

 

Separately, you can store bank account details, including account number, routing number, mailing address, phone number, etc.

 

I pull this up anytime I need to contact a credit card servicer.  Because you can add other details in memos, such as Trusted Traveler ID and values like various member numbers for rental car companies, Costco, frequent flyer numbers, etc,, Robofrom pretty much serves as my personal data organizer.

[StarkRaven$]

41 minutes ago, hdporter said:

 

Off topic:  Time to get yourself a secure password manager.  I use Roboform and it also keeps track of account details:  Issuer, link, login/password, account number, exp, CVV, cust svc number, etc. (incl CL).  You can even add notes as reminders of such things as late credit limit increase date.

 

Separately, you can store bank account details, including account number, routing number, mailing address, phone number, etc.

 

I pull this up anytime I need to contact a credit card servicer.  Because you can add other details in memos, such as Trusted Traveler ID and values like various member numbers for rental car companies, Costco, frequent flyer numbers, etc,, Robofrom pretty much serves as my personal data organizer.

Oh I do appreciate the tip HD. I'm looking into it now.

[StarkRaven$]

1 hour ago, hdporter said:

 

Off topic:  Time to get yourself a secure password manager.  I use Roboform and it also keeps track of account details:  Issuer, link, login/password, account number, exp, CVV, cust svc number, etc. (incl CL).  You can even add notes as reminders of such things as late credit limit increase date.

 

Separately, you can store bank account details, including account number, routing number, mailing address, phone number, etc.

 

I pull this up anytime I need to contact a credit card servicer.  Because you can add other details in memos, such as Trusted Traveler ID and values like various member numbers for rental car companies, Costco, frequent flyer numbers, etc,, Robofrom pretty much serves as my personal data organizer.

BTW, how long have you used Roboform? Do the yearly renewals stay consistant in pricing?

[hdporter]

My best guess is that I've been using Roboform since 2002.  Renewal offers and public deals vary,  I try to watch for a good deal and lock it in. 

 

They're currently offering a 30% discount, yielding an annual rate of $16.70, which can be subscribed to for up to 5 years.  That's likely as good as it gets at this point.

[A Credit Ed]

2 hours ago, hdporter said:

Renewal offers and public deals vary,

I've been using RoboForm free - a Chrome/Firefox/Edge extension - for the past 8 or so years.   It does everything the paid for version does EXCEPT being able to use it on multiple devices.  I prefer my laptop for financial stuff, so that isn't a deal breaker for me.  However, I believe I am royally screwed if I ever lose my laptop or if it decides to brick itself.  I think right now would be a good time to export and print a list of all UN/PWs.

Edit to add:  Holy crap - I have 334 user names and passwords in my RoboForm file.

Edited July 24, 2022 by A Credit Ed