Global merchant and card provider American Express issued formal regulatory notices to Australian credit card holders. The breach originated at an outsourced third-party service provider where a cloud repository containing merchant transaction logs was left exposed.