and that's assuming Camp Coleman is telling the truth that they believe no "unauthorized party" had downloaded the data. [who were the authorized parties, I wonder?] of course, Camp Coleman contradicts themselves when they say, "there is a strong likelihood that these individuals have found a way to breach private and confidential information"

That last four digits and the security number almost totally gives the card number away. Here's how easy it is for a merely mildly competent programmer(no special expertise required) to reconstruct the rest from otherwise public information.

Of the 16 digits on a credit card (excluding Amex at 15 digits - but the first four digits tell the computer which card this is so the computer knows what to expect), the first 8 digits determine which card issuer issued the card and is standard. The first four tell the specific card (MasterCard, Visa, etc) and rest of that first 8 digits are the credit card equivalent of a bank routing number as found on your checks.

The last four digits are a specific id for the unique card itself. I think the remaining four (9 thru 12) are digits that identify the (internal) code block the card issuer has issued the number from. But if you know the last four digits and the first eight are essentially standard and public knowledge, the rest aren't too hard to determine. The last four digits are what makes the card unique (which is the reason for the security code.it ads three of four more digits, and Amex uses only three in the last block anyway, so four is obviously critical for them as a security code. It brings them up to par with the other cards.)

The remaining third four digit block should not be that difficult for a good programmer to quickly duplicate. One or more of the digits in the number in the third block of four is probably a security check number to verify that the rest of the number is a valid credit card number (there is one), and it is a fixed number that depends entirely on what all the rest of the numbers are. That algorithm is public knowledge. Ask any programmer. It gives you that error "invalid credit card number."

If the check digit is one of the final four, then knowing it eliminates 90% of all possible total digits for the others in the number in the remaining 15, and you already know most of the rest. The check digit is the sum of all the rest reduced to a single digit by a publicly known algorithm, a process easy to reverse (and quick on a computer.) Knowing the first eight digits (public knowledge) means the third block can only be a combination of 10% of the possible digits there. Logically, the check digit must be in a publicly known location (I just don't know it or want to try to find it. I'm not programming a business application.) Such limitations on what the digits can be make a brute force effort to try one combination after another remarkably simple. Social engineering (look up the term. The scams to get people to tell you classified information without knowing what they are telling you are myriad.) might reduce even that. I might use the rest of the information, get a phone number for a card holder, call them up, tell them there has been a breach that released their name and ask them to verify the third block of four digits because the last four are so critical no one should know that. The third four digits are generic and no one will know all 16. One in three will tell me to avoid a theft of their card number if I convince them I am an official of the card company trying to protect their card.

I know this, and I am merely a nonprofessional computer hobbiest who has picked this knowledge up over the years by accident, without even searching for it. (My education is economics, finance and statistics with a lot of computer user time logged.) This is all off the top of my head. How hard is it for a professional computer person, or a dedicated hacker, to identify that third block of 0000 to 9999? That four digits iss 10,000 digits, duck soup for someone who knows what they are doing and has a computer they can write a quick program on.

By the way, I'm not giving you any information the criminals don't already know and pass around. It's the same rational as publishing the Anarchists Cookbook. This is probably well-known in the professional criminal training academies we call state and federal prisons. If you are a prisoner they can trust, just ask.

Not much security there without those last four digits and the security code being secret, are there? Give those digits away and the entire card is relatively easy to decipher.

Cynical enough to suit you? Every bit is out there to be used against you. You'd better hope I never get foreclosed on. I'd have to make a living, and this stuff is duck soup. I'd sell the knowledge. (Conservative free enterprise, you know.) The gypsy families and other professional scam artists trade this info regularly, as do prisoners in America's criminal finishing schools called prisons. But this is nothing that any mildly competent programmer doesn't also know. You are the target!!

Back in the military I used to think the Security people were obsessional monomaniacal idiots working to justify their jobs. Today I can only ask their forgiveness. Security guys, I am really really, really am sorry. You were right! And more than I could ever have kmown!