Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unencrypted Lost Tape Affects 230 Retailers

Posted by Soulskill on from the keep-an-eye-out dept.

Lucas123 tells us that a backup tape lost by Iron Mountain reportedly contains credit card information from 650,000 customers. The unencrypted tape also holds Social Security numbers for 150,000 customers. Quoting the Computerworld Article: "Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. 'Clearly that number includes many of the national retail organizations,' he said."

3 of 75 comments (clear)

  1. Re:Social Security? by BosstonesOwn · · Score: 2, Informative

    My Massachusetts license doesn't have my social security number.

    It was a known scam for some time to cause an accident on purpose (swoop and squat scam http://www.fbi.gov/page2/feb05/stagedauto021805.htm ) on a very nice vehicle perceived to have a high value. They would jott down your info including the license # which was your social security # and go on spending sprees with the victims credit info, while also collecting from the insurance company.

    --
    This package Does Not Contain a Winner
  2. Re:Broken system by Anonymous Coward · · Score: 1, Informative

    You really need to be able to authenticate yourself without handing over any secrets, i.e. by using some kind of protocol where you prove that you _have_ a secret (such as a CC# or SSN) without any requirement to reveal what it is.
    Sounds an awful lot like why public key cryptography was invented ...
  3. Re:Broken system by Peeteriz · · Score: 2, Informative

    Chip-cards do it - for example the EMV (europay-mastercard-visa) standard credit/debit cards - the card proves it's 'realness' by being able to execute cryptographical challenge-response, but not revealing (and thus, not allowing to copy) the secret key to anyone in the chain - not the merchant, not the POS terminal used, not the bank that processes the merchant's transaction (and still all these parties can and do verify that the transaction was signed by the billed card, and not injected by some middleman).