Slashdot Mirror

← Back to Stories (view on slashdot.org)

Newspapers Wrapped in Credit Card Data

Posted by Zonk on from the phish-wrap dept.

Buzzy's Roast Beef writes "The Boston Globe reports that bundles of newspapers in Worcester, MA were distributed wrapped in paper which contained subscriber credit card information for 240,000 customers. Those of you paying by check needn't worry; account and routing details for 1,100 customers paying by check were also given out like candy." From the article: "Larkin said the newspapers were first notified of the security breach on Monday by a clerk at a Cumberland Farms store. It took until late Monday for officials to confirm the data on the back of the paper were credit and debit card numbers. Senior management learned of the security breach yesterday morning, Larkin said. The company put out a news release late yesterday afternoon."

16 of 150 comments (clear)

  1. Access Control by imoou · · Score: 5, Interesting

    It should be a no brainer that financial information (not just credit cards) can only be access by the finance department, and any waste paper in the finance department must be disposed of by professional data destruction companies.

    The article explained the mistakes, which were caused by aborted print jobs, only those printed documents were in the bin for recycling!

    At least the the newspapers have now added a safeguard to the computer system so only the last four numbers of credit and debit cards can be printed.

    --
    Uncensored Google results requested and delivered by email
  2. For if it gets slashdotted by the-amazing-blob · · Score: 5, Informative

    1-888-665-2644 is their hotline "for customers to call to learn whether their financial information may have been distributed."

    Also:
    "As an extra precaution, newspaper officials also urged subscribers to contact their credit card companies if they are concerned about unauthorized transactions."

    This is a very serious problem

  3. The Boston Globe by Kesch · · Score: 5, Funny

    Subscribe for the articles, stay for your neighbor's credit card.

    --
    If this signature is witty enough, maybe somebody will like me.
  4. Need to print the data? by funkmeister · · Score: 5, Interesting

    Why does these data need to be printed at all? What possible need is there to see these numbers on paper?

    1. Re:Need to print the data? by SatanicPuppy · · Score: 4, Informative

      Honestly, and I work in the business, I can't even imagine one. We store all that data, but there is no commonly run report that prints it out. There isn't any point in it.

      If you pay by credit card with autopay, or similar, when your subscription is up, the system charges your card. It goes straight to the bank. It's not even a special job...Purely automated. The $$$ amount shows up on the batch report the next day, along with your name and subscriber ID and NOT your credit card number, because it would just be one more thing you don't need to look at on an already crowded report.

      At the same time, if someone is paying by check, as opposed to having the money automatically debited from their account every day, we don't KEEP the routing number...Why would anyone? We just keep the check authorization number. With that, you can get the routing number if you need it, for whatever reason, later.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  5. expensive subscription by pvt_medic · · Score: 5, Funny

    and you wonder why newspapers have been struggling recently. The price one has to pay to have a subscription is just too much.

    --
    30% Troll, 50% Underrated, 10% Interesting
    Score:5, Troll
  6. Don't piss off a geek by overshoot · · Score: 4, Funny
    I wonder if the Globe is thinking, "We should never have gone after Peter Quinn. HOW did he do that?"

    The nice thing about being an honest guy like Quinn is that the crooks never believe you.

    --
    Lacking <sarcasm> tags, /. substitutes moderation as "Troll."
  7. Sounds like Playboy by thaerin · · Score: 5, Funny

    I don't buy it for the pictures, I only read it for the occasional misprinting of hundreds of thousands of credit card information. *YOINK*

    --
    If big boobed women work at Hooters do one legged women work at IHOP?
  8. Why? by suwain_2 · · Score: 4, Insightful

    Why was this information even printed out? I can't think of any reason that they would need to print full credit card numbers out. This sounds like an incredibly foolish thing to have happened.

    --
    ________________________________________________
    suwain_2 :: quality slashdot p
  9. Oh the irony... by Soko · · Score: 5, Funny

    I clicked on the link in TFA, and got a page displaying an ad. 'For what?' you may ask.

    The ad was for American Express. ^_^

    Soko

    --
    "Depression is merely anger without enthusiasm." - Anonymous
  10. The industry is getting desperate... by Rob+T+Firefly · · Score: 5, Funny

    Everyone knows the newspaper industry is struggling to compete with the Internet, but they're really reaching nowadays, emulating the net's security breaches as well..

    --
    Slashdot Burying Stories About Slashdot Media Owned
  11. Heh. by SatanicPuppy · · Score: 4, Interesting

    Circulation and accounting are connected like two wrestling squid. Every night a whole series of jobs are run referencing all kinds of billing information to determine whose subscriptions are paid up to the point where they qualify to get a paper in the morning. So all the customer card/account numbers are processed by the circulation side, and sent in cash batches to accounting.

    So you see there is a financial subset inside circulation that deals with that billing info, which is why they have access to it. The reason it doesn't go straight to accounting is because, in most papers, accounting deals almost exclusively with advertising revenue and billing, which is a lot more complex than 15 bucks a month, or whatever the news subscription rate is, which gets billed automatically.

    All that being said, it took some kinda dumbass to dump that info out on the toppers, and a whole crew of dumbasses down the line to attach that information to the paper. Most places don't put anything like personal information on the toppers for papers they're distributing, so it should have been obvious to anyone that there had been a mistake...There are a LOT of people who should have noticed something was wrong.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    1. Re:Heh. by SatanicPuppy · · Score: 4, Funny

      If you can't raise the salary...Your corporate management is a bunch of money grubbing assbandits who are out for nothing but lining their own pockets...

      Woops. Typo. I meant to type "it's a complicated issue." The keys are all right next to each other.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    2. Re:Heh. by SatanicPuppy · · Score: 4, Insightful

      I'm not explaining the billing system, I'm just saying why the numbers are available at all.

      The way it works here is pretty similar to what you're talking about. Each customer has a unique ID. Now somewhere in the system that ID is connected to their credit card number (if they pay with it), but that part is never accessed by any reporting features. It's just sourced every time a billing request is generated by a weekly billing job in another part of the system. That job runs a charge on the card, and marks down the payment in another area, referenced by the customer ID and containing the date, amount, and transaction ID.

      There are two people here who have a high enough level of access to the system to write a report that would merge credit card and user data in a printable form. There are maybe three others who could look up any card they chose, but they couldn't generate any kind of report containing multiple cards. All the printers connected to that system are in a physically secure area.

      Basically we never do anything with the credit card number but generate billing with it. It's on no reports. Why would it be? What legitimate use is the credit card number to anyone except the authorized user? I passed the article around down here in the basement, and we all had a good laugh about it (first time we've been happy not to be the globe...heh), and none of us can even IMAGINE a scenario where printed lists of credit cards would be useful for any legitimate purpose.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  12. They don't comply by szembek · · Score: 5, Informative

    Apparently the Boston Globe Doesn't comply with the Payment Card Industry standard, found here: http://usa.visa.com/business/accepting_visa/ops_ri sk_management/cisp.html
    Specifically these sections:
    9.10 Destroy media containing cardholder information when it is no longer needed for business or legal reasons:

    9.10.1 Cross-cut shred, incinerate, or pulp hardcopy materials

    9.10.2 Purge, degauss, shred, or otherwise destroy electronic media so that cardholder data cannot be reconstructed

    --
    nothing
  13. Similar thing happened to me, maybe you too by c41rn · · Score: 4, Interesting

    I recently got a CD from H&R block to use when doing my taxes. Turns out that H&R accidentaly printed my social security number on the mailing label along with a string of other 'tracking numbers'. They sent a letter appologizing about it and saying that it had happened to a number of their customers. I still wonder why the shipping/printing department at H&R Block would have access to social security numbers at all.