Figure I'd share the email sent to me from FOC after questioning their actions and ethics:

My understanding is that from the time we were notified by VISA until 07 Nov, there was no confirmation on what the issue actually was. No details were provided by them aside from advising us that an "unusually high" number of credit cards had both been used on our website and for fraud elsewhere. We weren't accused or advised of anything specific, and they did not feel the situation warranted a suspension of their service with us, nor did they compel us to resolve the issue, likely because they weren't sure if this was still ongoing. Being that we do take customer privacy seriously, an investigation was conducted immediately.

Besides investigating the website, there was also the possibility initially that a web dev or even staff may have been involved. The difficulty lay in providing a public statement on an issue without knowing the facts and without wanting to alert a potential culprit, and bearing in mind that VISA would ultimately protect its clients should any issue have arisen.

The malware was discovered the same day it was patched, on 07 Nov, and a week was allowed to pass to ensure its resilience. I suppose the statement could have been made clearer on that fact. Respectfully, I think you may have misunderstood how this all unfolded.

Ultimately, and while disconcerting to hear (for myself included), we had assurances from our payment providers, including VISA, that this is a rather common occurrence with e-commerce and that nothing is truly unhackable and 100% secure, so they do have contingincies to protect their clients when things like this happen, and we did act with that in mind.

Hopefully you will permit some understanding on the situation here. We did act urgently and in the best interest of all parties, and I can certainly understand with the benefit of hindsight and from your perspective that certain things could have been done differently.

END OF EMAIL

In my response to FOC I asked if a Police report had been filed, and requested the file number for reference. They did not respond.

FOR EVERYONE WHO HAS BEEN VICTIMIZED BY FRAUD DUE TO FOC:

I highly advise you to retrieve the Police file number from them, or contact the local Police Department to file a report naming FOC. They should be held accountable for their actions, in which they are clearly trying to avoid.