American Express notified California residents that a data security incident occurred at a merchant where they used their cards. Account information, including card numbers, names, and expiration dates, may have been compromised. American Express systems were not directly breached; the incident involved a third-party merchant. The breach date is listed as December 7, 2013. American Express is monitoring accounts for fraud.