“MasterCard alerts do not identify the merchant by name, often because those alerts are sent out early in the investigative process and the facts around the intrusion continue to evolve,” MasterCard Chief Franchise Integrity Officer Eileen Simon wrote in her response to Dykstra. “Should an issuer choose to inform its cardholders that cards are being reissued in connection with a particular event, that is an issuer's choice. That choice should be exercised based on information in the issuer's possession and should not be attributed to MasterCard.”

Dykstra applauded the news.

“One of my clients has gotten in the last year five card replacements,” she told CU Times. “It was Target, it was Home Depot, it was Adobe, it was Michaels and one was a regional grocery store. And her comment to me was, 'What's wrong with my credit union? They must have really bad security, because they replaced my card five times.' So it changes how we inform the member. We can say [something like], 'We have been informed that your card information may have been accessed, and we see that your card was used at, say, Home Depot between this date and that date, and as a level of precaution and protection, we are reissuing your card.' So the member no longer looks at the credit union and thinks we're weak.”

Naming names carries one very significant risk, however: Issuers might name the wrong merchant. That could create a host of legal and reputational problems, which is why in their letters the networks warned issuers to be careful.

“Importantly, during the initial phase of a potential data breach event, there is often insufficient information to confirm a source of breached payment card data or where initial information suggests an inaccurate conclusion,” Thomson wrote. “Therefore, to avoid disseminating inaccurate information, we suggest waiting for public confirmation of a data breach event before disclosing information to customers.”

Law enforcement might also request keeping the merchant's name confidential to avoid alerting fraudsters, he added.

“It'll be interesting to see how it plays out, but it is a big relief to credit unions to be able to tell their members why that card is being reissued,” Dykstra said.