TCM Bank, a subsidiary of ICBA Bancard Inc., notified some 10,000 credit card applicants in the past week that their names, addresses, dates of birth, and Social Security numbers were compromised between March 2017 and the middle of July 2018.

TCM assists approximately 750 community and smaller banks with issuing credit cards to account holders. According to TCM, a website configuration that was mismanaged by a third-party vendor, exposing the data.

TCM refused to name the third-party vendor responsible for managing its website and presumably responsible for the compromise, but stated that the issue was corrected, and that it is requiring the vendor to evaluate procedures and technology to “detect and prevent similar issues going forward.”

This incident is a reminder of the importance of a vendor management program, including website hosts, and having contractual measures in place in the event of a security incident caused by a vendor, subcontractor, or other third-party.