Slashdot Mirror
Millions of Time Warner Cable Customer Records Exposed in Third-Party Data Leak (gizmodo.com)
About four million Time Warner Cable records containing details of its customers were found unsecured on an Amazon server last month, tech website Gizmodo reported on Friday. From a report: The files, more than 600GB in size, were discovered on August 24 by the Kromtech Security Center while its researchers were investigating an unrelated data breach at World Wrestling Entertainment. Two Amazon S3 buckets were eventually found and linked to BroadSoft, a global communications company that partners with service providers, including AT&T and TWC. The 4 million TWC records are not all tied to unique customers, meaning 4 million individual people were not exposed by the breach. Due to the sheer size of the cache, it was not immediately clear precisely how subscribers were affected. The leaked data included usernames, emails addresses, MAC addresses, device serial numbers, and financial transaction information -- though it does not appear that any Social Security numbers or credit card information was exposed.
Your information is only shared with our Trusted Partners ®
What could possibly go wrong??
slashdot: A failed experiment.
it does not appear that any Social Security numbers or credit card information was exposed
Earlier this month I switched to paperless billing for my Time Warner cable account. Two weeks ago I paid my bill online with a credit card for the first time.
Lo and behold, a fraudulent charged appeared on my statement last week! Someone bought some stuff from Neiman Marcus and had it shipped to Florida. (I live on the other side of the continent)
I was wondering where the security breach of my credit card was coming from, this makes me think it was Time Warner.
The part that really bothers me is that no matter how much work I do, how much security I try to add to my own systems, I'm still subject to the stupidity of companies that I do business with, and usually they're companies that I don't really have a choice about whether or not to do business with them (unless I wish to be a Luddite, living in a cave). This has happened with banks, cable companies, Internet providers, the freaking government, practically every computer gaming company and/or computer-related entity. And usually we find out through some cryptic message of "you need to change your password cause something may or may not have happened". It's really frustrating.
Sarbonn's blog: http://www.sarbonn.com/blog
My (unborn, unplanned, unexpected for a few more years) grandchildren will be getting free credit monitoring.
I've been seeing this a lot. Doesn't Amazon have ANY kind of security on their systems?
Pretty sure he's not interested in Hillary's snatch.
He couldn't afford it anyway, and besides, Ivanka.
Time Warner Cable is now Charter. They need to be severely penalized. This is negligence and their response is asinine.
My personal information is almost certainly among the four million subscribers in the breach. I have used the My TWC app, and yes, I've paid my bill through it. The unsecured data was discovered on August 24. As of right now, Charter has made precisely zero effort to notify me.
Although the focus is on the four million customer records, it's not entirely clear what else has been compromised. The Gizmodo article about this includes the following text:
The servers also contained a slew of internal company records, including SQL database dumps, internal emails, and code containing credentials (usernames and passwords) to external systems - information that could've been used to uncover additional sensitive subscriber records.
In other words, the true scope of the breach may not be known. If a third party security researcher was able to uncover this information, can they truly be confident that others didn't access the information and use it for malicious purposes?
A spokesperson for BroadSoft said the company had verified that customer data was exposed to the public internet, but that it does not believe the information to be "highly sensitive." The company also does not believe it was accessed by anyone with malicious intent.
These claims also limit their requirements to notify customers under state data breach laws.
"We immediately secured these Amazon S3 bucket exposures and are continuing to aggressively investigate these exposures and will take additional remedial actions as needed."
In other words, their previous statement was bullshit. They don't know what was accessed. They're being weasels to limit their requirements under law.
Finally, from Charter's own statement, quoted by Gizmodo:
We apologize for the frustration and anxiety this causes, and will communicate directly to customers if their information was involved in this incident.
As I stated, my personal information was almost certainly involved in the breach. They haven't notified me, and there's no reason they couldn't have sent even a mass email by now. It's been several days.
Finally, this is incredibly negligent. There is absolutely no excuse for storing sensitive information on a server that can be accessed by the public with no credentials whatsoever. The negligence was apparently due to outsourcing some aspect of their business to Broadsoft, a company in India, whose CCTV recordings were also stored on the server. Even if nobody has their personal information abused from this data breach, Charter needs to be severely for their negligence. They are still responsible, despite having outsourced to a firm in India. I also don't much like their lack of notification and their misleading statements downplaying the breach while they don't really know what was compromised.