ATTACKERS HAVE 16-DIGIT CARD NUMBERS, EXPIRY DATES, BUT NOT NAMES. NOW ORG GETS £500K FINE

Summary from the TLDR InfoSec newsletter

The UK Court of Appeal has backed the ICO's £500k fine on DSG Retail over a 2017 breach that exposed 5.6 million card details and data on 14 million people, even though attackers lacked cardholder names. The ruling confirms that payment card numbers and expiry dates are personal data from the controller's perspective, stresses jigsaw identification risk, and strengthens regulators' ability to penalize weak security in future cyberattacks.