Ask HN: Crap, I just downloaded over 10000 Credit Card Numbers - Now What?

I'm a developer in the freelancing/early startup phase, and had a client ask me to look at their current CMS/Online Store. I found out that the service they're using is storing credit card numbers, names, addresses, phone numbers, and cvv - probably in plaintext too. Obviously this is NOT PCI Compliant!

I poked around a bit to see wtf is going on and unintentionally dumped the entire db of 10,000+ credit card numbers, cvv, etc. For ALL of the system's users!

I'm a good person, and I really would rather not use this information incorrectly, so what's the right thing to do that won't land me in jail?

If anyone is wondering the shopping cart service is apparently based in PHP.

Edit: I didn't make it clear enough, this is a service - like shopify - but definitely NOT shopify :) Appears to be locally operated, and has a good number of local clients.

- Did you delete db from your local computer? If not, do it now.

- Inform your client about the problem and how you can fix it.

- Fix it.

Is this a custom store or a package out there somewhere? The latter would be pretty scary.

When I purchased a business I found a DB with all customers CC info in it while doing my due diligence (it was a crappy cart system written by some guy overseas). The seller was surprised they were there, but didn't seem to grasp the gravity of the situation ($150,000 fine for example).

I had my purchase contract written to explicitly say that I was not purchasing the CC info, and I left no trace of the numbers on my computer. IANAL, but I figure if I didn't obtain the numbers and I don't have the numbers I should be fine.

I'd recommend you tell the client about the problem. Offer to fix it, and make sure there is no trace of it on your computer. Probably worth asking a lawyer, but I don't see what else you can do.

In order to help I'm going to need the URL...

Just kidding.

1. Delete the data. 2. Call the client. 3. Explain what happened. 4. Prepare to be blamed. 5. Do the right thing anyway.

They are hard because there is always risk that an "obvious" decision will create civil or criminal liability. A lawyer can help you assess and mitigate that risk.