Ask HN: Data breach disclosure for one man SaaS
I was notified of a breach and got the following email. Is it good enough to say I didn't have the money for security?

>>MESSAGE

LOST PET FINDERS DATA BREACH NOTICE
Dear Customer,

I am writing to you because of an incident involving access to information associated with online purchases made on my website lostpetfinders.co.nz. I am providing notice to you and other potentially affected customers about the incident, and about tools you can use to protect yourself against possible identity theft or fraud.

What Happened?

I was recently informed that my website lostpetfinders.co.nz was a Common Point of Purchase (this meant that my site was compromised) by my merchant provider.

The period of possible compromise started on November 2019 through April 2021.

I do not store any card numbers including the CCV and expiry date. This is not how the attacker got to the information. Instead, the attacker put keyword logging code onto the site to capture and send data as it was submitted.

My site is self-administered, and it was my system that experienced the intrusion. The intruder or intruders placed malware on the server, and by doing so may have gained access to your payment card data including payment card numbers as customers made transactions on the system. Because you have provided your payment card information to me in the past, I am notifying you about this data breach.

What Information Was Involved?

The information that the attacker had access to includes your first and last name, your address, your phone number and any debit or credit card numbers with expiration dates you may have used on my website.

What Are We Doing?

We have engaged the service of a leading cybersecurity firm to assist with security improvements to ensure we are compliant with Payment Card Industry (PCI) Data Security Standards and we have reported the breach to privacy.org.nz.

What You Can Do?

To protect yourself from the possibility of identity theft, I recommend you immediately contact your credit or debit card company and inform them that your card information may have been compromised, so that they can issue you a replacement card. Review your banking and card statements and report any suspicious activity to the relevant financial institutions.

For more information on identify theft, I suggest that you visit the Office of the Australian Information Commissioner's website office at privacy.org.nz.

On a personal level

I deeply apologise for the breach. I was left to self-manage the website after the developers who built the site closed down approximately 7 years ago. Financial restraints prevented me from finding a new development company so I developed the site over that time but without proper maintenance of the website security it was ultimately breached. You trusted me with your information and I have let you down. Again, for this I deeply and most sincerely apologise.

I take full responsibility in ensuring the ongoing security of the sites are maintained to industry recommended standards so hopefully I can continue to provide people in the community who have lost or found a pet a recourse for repatriation.

>>EOM