Slashdot Mirror
Largest Data Breach Disclosed During Inauguration
rmogull writes "Brian Krebs over at the Washington Post just published a story that Heartland Payment Systems disclosed what may be the largest data breach in history. Today. During the inauguration. Heartland processes over 100 million transactions a month, mostly from small to medium-sized businesses, and doesn't know how many cards were compromised. The breach was discovered after tracing fraud in the system back to Heartland, and involved malicious software snooping their internal network. I've written some additional analysis on this and similar breaches. It's interesting that the biggest breaches now involve attacks installing malicious software to sniff data — including TJX, Hannaford, Cardsystems, and now Heartland Payment Systems." One bit of good news out of this massive breach is that, according to Heartland's CFO, "The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address." Heartland just put up a press release on the breach.
I would say it may have quite a lot to do with it... it's either a pretty big coincidence, or they are trying to bury the news by releasing it when the networks actually have something else to report on.
What's your bet on?
The implication is that they timed the announcement to occur when no one is paying attention.
We hope your rules and wisdom choke you / Now we are one in everlasting peace
Today. During the inauguration. WTF??? What does the inauguration have to do with this?
Well, somebody who is inclined toward cynicism might conclude that the company deliberately chose to release this information when public attention would be diverted elsewhere.
If libertarians are so opposed to effective government, why don't they all move to Somalia?
This is why I never go on the internet. It's just not safe.
"Legal reviews": "Holy crap, we're gonna get our butts sued off if this breach becomes a big news story! You have to delay this until we can start a war or something to distract the press!"
"Will the inauguration hype of the first African-American President of the United States work as a distraction?"
"Brilliant!"
Welcome to the Panopticon. Used to be a prison, now it's your home.
"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said.
Because as we all know it is impossible to get someone's address by having only their full name and credit card number.
They are trying to down play a very serious incident by disclosing the breach on a day heavily focused on the inauguration. Then they have the nerve to say "don't worry they didn't get your address" as if to say someone smart enough to embed malicious software which gathers credit card numbers is not smart enough to find someone's address. Common!
/whisper/ Thanks for the candy!
Nearly every company that suffers a breach like this tries to assure people about what the bad guy's didn't manage to steal. Don't believe it. Even if it might be true at the strict technical level, it's still not relevant to the analysis of the severity of this issue. The bad guys already have databases full of names and addresses which they will cross reference against the data they stole.
If you mod me down, I shall become more powerful than you could possibly imagine.
"Researcher says Linux is better than Windows on Pedantic Asshole day."
There, is that better?
Same reason Clear Channel laid off 8% while this was going on. :-)
Not to mention that it would seem that it would be in their best interests to get the word out to minimize losses.
Oh, they've already got that covered:
In other words, "Yeah, technically it was a breach, but you know, not enough data got released for us to actually be provably liable. So if your CC gets raped, you know, it's not our fault. Really. Trust us. ;)"
In related news, now we know what happened to the Iraqi Information Minister: He changed his name and became President and CFO of a large credit card payment processing company.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Then prove it - what is the security code on the back?
#
#\ @ ? Colonize Mars
#
Yeah, but that was good news...
And Linux is always better than Windows on Slashdot, because every day is Pedantic Asshole day here!
Welcome to the Panopticon. Used to be a prison, now it's your home.
The breach happened last year. What's the betting that the first customers know about it is when faudulent activity is showing up on their credit cards.
The first instinct of Heartland is to save itself and the first instinct of the banks will be that it can rate jack its customers if the new activity has put them overlimit.
Only after leaking of the news is inevitable and can no longer be delayed will Heartland grudgingly try to sneak it out under the radar and then in a general, untargeted sense, not directly to the customers involved. Nothing will be done to avoid spreading the pain to a card holder or to a vendor.
I dare say most of the legal wrangling was in how to spin this as a justification to claim from TARP.
Nullius in verba
Well, somebody who is inclined toward reality
No need to thank me.
Also, FTFA:
Heartland called U.S. Secret Service and hired two breach forensics teams to investigate. But Baldwin said it wasn't until last week that investigators uncovered the source of the breach...
Meaning they knew about it long enough to hire some forensics teams, do the research, figure out where the breach came from, etc. and they finished all that up last week...and then decided to wait until NOON today to release the news to the public? Sorry, but that's plain bullshit, no cynicism involved. If they were interested in disclosure, they would've released the news sooner. At the very latest, they would've released it as soon as they found out how it happened (so they could say they had already closed the breach.)
Instead, they wait until noon (they're a New Jersey company) when the inauguration is happening? Why not sooner in the day? Why wait until what would arguably be lunch time usually? Who discloses breaches at lunch? Answer: nobody. On the other hand, who discloses breaches during a HUGE national (and arguably international) event? Answer: someone trying to hide something.
Again, I say inclined toward reality, not cynicism.
Their may be a grammatical error, misspeling, or evn a typo in this post.
Some clueless person says this every time there is a story on credit cards.
Visa/MC do not end up paying. Merchants on the receiving end of fraudulent transactions do. Visa/MC may even profit from it as the fees they charge merchants for chargebacks can be quite steep.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
What's needed is a totally new kind of online financial transaction system. One that don't use card numbers. A dongle on the client connects to the server generates a one-time session key,and identifies itself to the server and displays a random Pin code, the customer then types it in to verify the transaction. The session is encrypted and the data sent can only be used for the one transaction, no repeat man-in-the-middle hacks ..
davecb5620@gmail.com
Because they are the ones processing the transactions. We don't use heartland, but when take online orders through our website, we don't store the credit card information, our CC Processor does. The processors are the one that actually run the transactions, take money from the customers account, take a percentage, then deposit to the merchants account. And they have to keep records of all that.
In order for CC payment to work someone has to store that data somewhere.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
No, they are liable and are going to pay through the nose, but not for "identity theft". They will be responsible for improperly securing their network and permitting the theft of the cards. But identity theft is a different beast. No one will be able to sign up for new credit cards and or loans in the names of the people whose data was compromised.
Well.. maybe. Or Maybe not. But Definitely not sort of.
Incidentally, I got a call this morning about an hour before noon EST from Chase. They said they "received information" that my credit card information was compromised. The only suspicious charge was from November, which I didn't notice on my own. This is also the only time Chase has done anything but screw me, so I was pleasantly surprised that they were dealing with it so well. Now I see this and think "hey, I'm part of the largest ___ in history!" Sweet.
Those who claim to be perfect but never admit mistakes usually are covering up for massive mistakes.
And the missing million emails we know of are just the observable symptom, as are the transactions in this health data breach.
The old truisms of data security still apply:
1. It's usually insiders that provided or passed on information used to get access.
2. Those who cover up problems only create even larger problems, due to the system of trust.
3. You can stop 99 percent of attacks with reasonable security measures, but a determined attacker willing to use human intelligence methods will almost always get through the other 1 percent - the trick is knowing what measures will dissuade the 99 percent and implement those, and use reporting to discover the other 1 percent instead of measures that will be defeated anyway.
-- Tigger warning: This post may contain tiggers! --
Same thing happened to me back in December. I too have a Chase credit card. My card got declined on a couple purchases so I called them about it. They knew exactly which charges were fraudulent and had already reversed them and closed the card so they could send another with a new number. Interesting that the charges were rather small.. a $5 Netflix charge, maybe a couple $20 or $30 charges, and out of the dozens of legitimate charges per month my wife and I make, they knew which ones were bogus.