Slashdot Mirror
Stratfor Breach Leads To Over $700k In Fraud
wiredmikey writes "It isn't often that after a data breach involving credit cards, the public is given information on the exact amount money lost by consumers as a result. Thanks to the FBI, however, we now have a better understanding of what 60,000 stolen credit cards translates to financially, as this data was included in their investigation notes while working the Stratfor case. The last time the public had something close to actual stats from the source, we learned that the TJX breach cost Visa $68 million in 2007, two years after the TJX network was compromised by Albert Gonzalez. Yet, those were Visa's estimates. Now, in the aftermath of the Stratfor breach, the FBI has attributed $700,000 worth of charge fraud to the 60,000 credit card records taken during the network compromise. AntiSec supporters walked away with 860,160 usernames and passwords, in addition to the credit card records."
Money.
Not "leaked documents" or "liberated intelligence."
Plain old fashioned credit card fraud.
I do not fail; I succeed at finding out what does not work.
What the summary doesn't make fully clear IMHO is that the cost of this fraud is not carried by VISA or the banks, but rather passed on to merchants ... who ultimately pass the cost on to anyone who uses credit cards. That is unfortunate, because it means the organizations financially incentivized to solve fraud are the ones who can't do anything about it. The organizations who can make these things more secure don't pay the price, which may explain why credit cards are still so insecure.
Credit card fraud is a huge illegal industry. It finances drug gangs and cartels, terrorists, small organized crime, major organized crime (mafia), and occasionally the rogue individual hacker. It's the new form of armed bank robbery. Instead of guns they use computers though.
Of course while $700K in fraud by a few people is nothing to ignore, it is a bit ridiculous that the FBI devotes so many resources to catching these scumbags, while virtually ignoring the guys who swindle billions of dollars through stocks, insider trading, and pyramid schemes.
Will Stratfor pay restitution to the victims for its criminal negligence in storing customer's credit card data insecurely / without encryption?
I like how they said "money lost by consumers..." but did the consumers actually have to pay it?
We're talking about the same FBI, yes?
Durring the Great Depression, gangsters and bank robbers were pop-icons and even cult hero's in the U.S because they were perceived as sticking it to "the man". This is strikingly similar, we have a group of thieves trying to cast their actions as being for the "greater good".
These credit card numbers were released while Sabu was under the control of the FBI!
It hasn't costed Visa that much, unless it's overhead costs.
Merchants don't get to keep fraudulent payments, VISA gets that money back. So only costs VISA would accrue is on the "overhead" bracket.
Pulsed Media Seedboxes
It's interesting now that we know Sabu was working for the FBI. I read in several articles this past week that the FBI used Sabu to put a halt to a few hacking jobs. Since the FBI didn't put a stop to this one, shouldn't they be considered an accomplice in the Stratfor job?
Not "leaked documents" or "liberated intelligence." Plain old fashioned credit card fraud.
You have made several possibly incorrect assumptions here:
1. That AntiSec was the only group to hack the card data
2. That AntiSec profited from this crime, either by committing the actual credit card fraud, or selling the card data to someone who did
3. That AntiSec is a monolithic group with a management structure that can command its minions to do/do not do/whatever with data they obtain therefore making the group responsible for the actions of an individual
...to pay Stratfor for intelligence crap....you really have to think "Live by the intelligence crap, die by it...."
Lots better than innocent people dying due to intelligence crap...
By day, he's a mild-mannered Attorney General. By night, he becomes an uber-hacker who compromises Visa. Coolest duality ever.
Oh wait, we're missing an 'o' on the end. Never mind.
The leak happened in early December, but Stratfor did not notify its subscribers until December 24th. They offered a "free" subscription to CSID indentity protection service which, when activated, notified you that Yup, your username, password, and credit card number were hacked, something you could verify for yourself on the web. So there was at least a two week lag where they knew of the breach, but did not tell anyone so as to not "compromise" the FBI investigation. They SAID they notified the cc companies immediately, but the fact is the cc companies did not notify subscriber or initiate any action. Subscribers, once they found out on December 24th, had to do this on their own.
The large majority of cards were not used in any way, but the email addresses were used to send spam to subscribers, including bogus messages that Friedman, CEO of Stratfor, had resigned. Petty stuff, that.
Lifelock, which purports to be an id protection service, finally got around to notifying its subscribers of a data breach in mid January with a generic notice and no corroborating information at all.
As of today Stratfor has not yet re-established its service, though they say it will be Real Soon Now.
How about a moderation of -1 pedantic.
Of course, you should compare and contrast that to the gargantuan amounts stolen by the banksters, sonny. Try that for a change!
nt = no text
I use Citi Mastercard for online purchases. Citi offers a "virtual account number" feature that can be used to generate a one-time-use number for a specific purchase. I've not had anyone yet attempt to use a number a second time, but if it happens they won't be successful, or so Citi claims.