Slashdot Mirror
Lost Credit Data Improperly Kept, Company Admits
Zak3056 writes "Last week, Mastercard announced that up to 40,000,000 credit card numbers may have been compromised by one of their processing companies. Today, the New York Times (registration, along with first born child, required) is reporting that the company in question, CardSystems Solutions, should not have been retaining that data to begin with. John M. Perry, CEO of the processor in question, claims the data was merely being kept for 'research purposes.' The number of compromised Master Card accounts has been revised downward to about 68,000, with another 132,000 possibly compromised accounts belonging to Visa, American Express, and other companies."
Am I reading this correctly? 40 million down to just over 60 thousand? I mean, if the latter figure is correct, this is a MUCH different (less major) story.
== Jez ==
Do you miss Firefox? Try Pale Moon.
I'm sure it's been mentioned every time a NYT article is posted, but use the NYT Link Generator .
Btw, NoReg for this article.
Your hair look like poop, Bob! - Wanker.
If I have been able to see further than others, it is because I bought a pair of binoculars.
the data was merely being kept for "research purposes."
well, that makes it ok then. NOT!
This isn't an error at all, it's actually a *feature* of your credit card agreement. Gets your card number out there so you don't have to bother giving it to retailers - they already have it!
or else!
my geeklog
Can you say "lawsuit"? This was a total lapse in judgement in keeping data they shouldn't have compounded with the fact that they didn't secure their network. I'd place money on this company not surviving this error. Even if the loss of money in settlements doesn't break them, I'd bet they will lose most of their future business because of this (and rightly so).
But why is the rum gone?
Here is the reg free and "fricken huge flash ad skip" link.
I just heard that they revised the numbers again. Now it appears that the lost data is actually just 4 credit cards. And they're all Fashion Bug cards so it would be really easy to spot them if they were used illegally.
Pulp Audio Weekly - Geek News and Reviews
Apparently, keeping credit card numbers secure isn't working out. Why? Because it's just a number. The major credit companies need to revise how the whole credit system works. If they assume that everyone knows everyone else's credit card number by default, they should be able to devise a system a hell of a lot more secure than some 16 digit number. Your credit card number has to be retained by anyone you do business with so that they know who you are. Credit card security needs some major improvements, like a passphrase, password, or even a PIN. A 4-digit PIN would make a world of difference, but if you're going to fix it, you should fix it right. A passphrase would be best. Something that's communicated when the authorization is taking place, checked against a nice secure server, and then is forgotten and not retained. The fact that a system of this nature is not yet in place just shows that the major credit card companies just don't give a shit.
/end rant
Aero
Please stop hurting America -- Jon Stewart
I don't wanna be a troll here, but please, there are a dozen other sites that have the same article. Do we have to rely on a site that requires u to log in?3 513866/
http://www.internetnews.com/security/article.php/
Let's face it, credit cards have never been save and will never be save!
It's the price you have to pay for the convenience credit cards offer.
Internet connection - $30
Homemade Computer - $700
2 Liters of Mountain Dew - $2
Stealing 40 Million people's credit card information with your 1337 h@x0r s|i77z - Priceless.
There's somethings that money can't buy, but for everything else, there's MasterCard.
Don't take life so seriously. No one makes it out alive.
It makes sense that the companies that are retaining CC data improperly would be the ones most likely to allow it to be compromised.
The security of the data is nothing more than a second thought to many of these companies. If they feel they can keep around a huge data mine of everyone's data they can get their hands on, in violation of the proper procedures, it should come as no surprise that they wouldn't be that vigilant in securing it properly.
Once again, evidence that there should be criminal penalties for improper handling of personal information. If you collect it, you better make sure it's safe. Otherwise, stop collecting it.
No these idiots were completely hacked. The only thing they know for certain is that the files they were illegitimately retaining were unprotected and thus vulnerable duing the break in. But someone who could compromise them that badly might very well have been intercepting all the transactions they did not retain. Since these folks think vb scripts are good protection they are probably clueless about security and assessing intrusion.
Some drink at the fountain of knowledge. Others just gargle.
Translation: ``We've come up with some fiction which will let us maintain plausible deniability next time we lose data we shouldn't have had in the first place.''
As for the sensitive data, he added, "We no longer store it on files."
Translation: ``We're going to come up with some nifty new word to replace the word `file', so we can truthfully say that we no longer have your data in our files.''
More seriously, it makes good sense to me that they were retaining data for research purposes. They'd be irresponsible not to, just as surely as they were irresponsible not to have an air gap between that data and the internet.
See what I've been reading.
I'm on the run from the feds so I couldn't register and read the article, but their excuse is that they were keeping it for research purposes? Seriously? That's the best they could come up with? "Oops" is better than "we were keeping it for research purposes." 'Cause I'm pretty sure none of your customers are going to be happy that you're being negligent with the thing that gives people access to huge amounts of their money so you can keep track of how much toilet paper they buy.
We need a new system based on PGP or something. A system where we have single-use transaction numbers, and you have give a PGP signature for each usage of a transaction number. Right now it's way to easy for hackers to steal credit card information, or for unethical merchants to make unauthorized charges. We need to put the consumer back in charge of their own finances.
Currently , any 'merchant' can charge whatever they want once they have your credit card number. Sure, you can issue a chargeback or contest the charges, but why should *you* have to clean up after someone messes with your account? It's ridiculous.
Computers are useless. They can only give you answers.
-- Pablo Picasso
"The number of compromised Master Card accounts has been revised downward to about 68,000, with another 132,000 possibly compromised accounts belonging to Visa, American Express, and other companies."
Is that so? I'm going to have to throw the bullshit flag on this one. Any numbers that add up to a nice round number like '200,000' are complete crap that someone pulled directly out of their arse.
I'm sorry, but I just don't buy it. I say they don't have a fucking clue how many numbers were exposed.
Aero
Please stop hurting America -- Jon Stewart
People have to realize that privacy isn't just some criminal's ideal to keep from getting caught. If the data is out there it will be seen, hacked, sold and abused.
----
Go canucks, habs, and sens!
For those people who pay attention to the news, 40,000,000 cards compromised, that would be basically every card they handle assumed to have ben compromised, an imprtessive feat indeed. The person would have had to have a consistent and unnoticedconne3ction to the server, or walked out with a burned dvd or two of information.
The other interesting mathimatical issue that came up was the child molester in Oregon, he was reported to have molested 30,000 kids over 35 years, 12 of which he spent in jail, hmmmm
that would be over 4 seperate kids a day.
I can't even find a way to molest 4 seperate drunk girls in a night with out at least one of them telling someone. I am calling bullshit on this one.
Like arts? Like cheesy little Indie mags? Check out www.artwerkmag.com, and don't laugh at the bad coding please.
According to the article, the company in question has *never* been in compliance with MC's security rules. Since MC is supposedly doing audits and all, why have they not terminated the account and awarded it to someone else? They're leaving themselves wide open, and they're a much bigger target than the company that got caught.
Damn it, I'm sick of this weekly news of credit card security breaches. In this case the data wasn't even encrypted.
"Zero liability for customers means that fraudulent charges come out of a bank or store's coffers in the form of higher merchant transaction fees. 'The retailers will pay for it and the issuing banks will get rich off it,' Ms. Litan said. 'It's just another revenue stream.'"
Sorry, I call bullshit. Retailers pass the higher costs onto you and I.
"'We should not have been doing that,' Mr. Perry said. 'That, however, has been remediated.' As for the sensitive data, he added, 'We no longer store it on files.'"
Thats just fine Mr. Perry. Now may I have the credit card numbers, addresses, phone numbers, ss#'s, etc. of you, your family and the execs at Cardsystems Solutions? I *promise* to keep them safe and give them the same care you provided the other customers....
From TFA:
Jessica Antle, a MasterCard spokeswoman, said that CardSystems had never demonstrated compliance with MasterCard's standards. "They were in violation of our rules," she said.
Asked about compliance with Visa's standards, a Visa spokeswoman, Rosetta Jones, said, "This particular processor was not following Visa's security requirements when we found out there was a potential data compromise."
Question:
Why is CardSystems Solutions still a processor for Visa and MasterCard?
The article alludes to fraudulent activity starting back in mid-April leading to an investigation of this particular card processor in mid-May. That suggests that the card companies do some rather interesting statistical analyses on fraud patterns to find commonalities. In this case, they were able to detect that an unusual number of cards with fraudulent transactions had, at some point, a transaction that shared a common card processor sometime in the past.
Obviously, someone (I assume its Mastercard, Visa, etc.) is storing sufficient volume of historical transactions (including metadata such as the 3rd-party transaction processor) to analyze patterns such as this. With some 60 billion card transactions per year worldwide, this would make for a very large dataset and a very interesting analysis problem.
Two wrongs don't make a right, but three lefts do.
Are we hearing about this more, or is it happening more?
We're hearing about it more because California passed a new law requiring disclosure of privacy breaches. California citizens get notified and that opens the story to the news media.
By the way, this is the same California that the conservatives love to bash for being "anti-business".
You're welcome.
It's simple: I demand prosecution for torture.
John M. Perry, CEO of the processor in question, claims the data was merely being kept for "research purposes."
Well, that makes it all OK, then, doesn't it? So long as it was for Science.
-EvilMagnus
Credit cards never have been safe, but that doesn't mean that they can't ever possibly be safe.
There are ways to do secure payments, usually involving cryptography. Generally, it works like a "digital check" where you create an authorization for a payment, digitally sign and date it, and then hand it over. They never have access to your credit card number, because the real secret is your private key, which never leaves your PDA/smart card/phone/etc. Your bank ensures that the "check" is only cashed once, and because of the crypto it can't be forged or altered without immense resources.
So why haven't we implemented this yet? Infrastructure, mostly. There's a LOT of infrastructure for the present system. It's expensive. Smart cards are expensive. The only thing that's more expensive is credit card companies getting massively ripped off. Perhaps you'll be getting your smart card right soon.
Perhaps not. Another reason is that the infrastructure represents a substantial agreement between the major credit card companies. Changing it involves getting a lot of people to agree on something. That's hard to do, especially when it has to be RIGHT. If they choose the wrong crypto algorithm, or if there are other weaknesses in the system they choose, you could be WAY more doomed than 68,000 missing credit card numbers.
So while there is a tradeoff between convenience and security, there are clearly better balance points than the one we have. Sadly, as long as inertia is an even stronger attractor, we may live this way for a while longer.
What are the contractual damages for violating there agreement?
I think $50 / incident is probably reasonable. That's enough to get the attention of the mom and pop store that might be facing damages of ten thousand dollars for improperly storing the CC numbers of a few hundred customers, but it's no so overwhelming that they would be forced out of business.
A major processor that held 40M records (assuming that that was the number of improperly held records, and the lower number were just those that might have been exposed). They deserve a $2 billion contractual damage.
Mastercard would never collect that much in damages, of course, but it would be a corporate death sentence to any company -- and its executives -- deciding to do illicit "research." One prominent case could go a long way towards restoring confidence.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
This story on npr says that the credit card companies can actually wind up making money when a fraudulent charge is made. Does this create an incentive for them to keep things safe?
--- http://davidnehme.blogspot.com
We used them as processors for about a year. We couldn't get rid of them fast enough. They hid all sorts of fees in our merchant charges and the "great deal" we got from them had so many exceptions that it was worthless. It left a real bas taste in my mouth. I sure hope they get the same treatment in reverse. Ha!
That's what I want to know: when will companies that mishandle data like this be held 100% responsible to the people whose data they mishandled for the losses, fraud, etc.? I'm of the opinion that only when mishandling data results in actual financial consequences to the mishandler will things change.
You would have to go home and authorize it.
Doesn't really help with impulse buying.
Personally, I think all credit card transactions should be PIN based rather then simply signature.
Then lets get wild...
Let's increase the digits a bit in length? Now, card numbers are issued every six months? Or if you want to opt for an online-only card #. You can get a new one every month or two months.
I really hate keeping the same card number for years. It almost gurantees that some asshat will store my data and get it ripped off like this.
In fact, if a card has too much internet wear and tear... I tend to "lose it" and require another one to be reissued. It's an odd quirk of mine.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
The technology is based on digital signatures and electronic wallets. It's quite sophisticated. Perhaps it's time to dust it off and give it another whirl.
Essentially they are just that: best practices. I just did an audit prepping a company for Visa CISP certification and most things they require are pretty standard like password complexity, physical security, encryption used over public links, etc.. However the security all revolves around the credit card number so it's a little more focused than a normal security gig.
Also, Visa/Master require that vendors store as little info as possible in as few places as possible, and that they encrypt it in storage. Specifically no one is EVER supposed to store the CVV/CVC code or any portion of the magnetic stripe info. Also specific to this set of requirements, a subpoint of it being CC#-centric, is that even non-mission-critical systems have to have the same high level of security if they store CC info. So no one gives a shit if you are doing "research" or just processing sales, you HAVE to protect the numbers, ideally by encrypting that field in Oracle or something equivalent so when FedEx loses your backup tape it isn't a disaster.
One last caveat is that the program is still ramping up. It started about 4 years ago but most companies are struggling to implement the reqs still, and Visa is very understanding since if they are too stringent and cut off the offending vendor they lose revenue.
I got two emails from my bank today (10:52am and 4:59pm EST).
Dear Customer,
An incident involving unauthorized access into a third party processor system has occurred. A company which processes transactions for physical retail merchants and Internet merchants was the victim of a computer hacker between September 2004 and May 2005. They have identified your check and/or credit card as one of the cards possibly exposed. Information compromised includes account numbers and expiration dates, as well as cardholder names and addresses.
We understand that you will most likely be concerned when you read this. Rest assured that if you information has fallen into the wrong hands, you will not be liable for any unauthorized transactions using your Check Card or VISA Card*. However, it is very important that you monitor your account(s) closely and notify us immediately of any unauthorized transaction. If such a transaction does occur, you will need to complete a VISA dispute form, available through the maintenance area of our online banking system, in order to receive provisional credit for the amount of the transaction. We recommend, as a precaution, that you call Customer Support to block your card and we will re-issue a new one. Our Banking Specialists and Loan Representatives will make that decision with you on a case-by-case basis, as we do not want to hamper your use of the card.
We also understand that you will have other questions, such as the identity of the processor. When we receive notifications of this variety from VISA, VISA does not and will not reveal the name of the merchant or processor unless the incident has already been made public by the merchant.
Again, we do ask that you monitor your account carefully in the weeks ahead by making use of our telephone, wireless, and online banking systems. If you have any questions or concerns, please contact a Banking Specialist or Loan Representative for more information.
Thank you for banking with us.
*This limit on liability does not apply to PIN-based ATM or point-of-sale transactions.
Belive in Technology and AMAZE yourself. -- RIP ZDTV/TechTV