Slashdot Mirror
Malware Attack on Vendor To Blame for Delta and Sears Data Breach Affecting 'Hundreds of Thousands' of Customers (gizmodo.com)
Delta Air Lines and Sears Holding on Thursday disclosed a data breach that may have exposed the payment card details of hundreds of thousands of online customers. From a report: The breach originated at a software vendor called [24]7, which provides Sears, Delta, and other businesses with online chat services. Less than 100,000 Sears customers were supposedly impacted, according to Sears. A Delta spokesperson said hundreds of thousands of travelers are potentially exposed. Gizmodo has learned the breach was the result of a malware attack, and that the unauthorized access involved payment card numbers, CVV numbers, and expiration dates, in addition to customers' names and addresses.
In a statement, [24]7 said the breach occurred on September 27th of last year and was contained roughly two weeks later. In a statement, Sears said it was first notified about the breach in mid-March. Credit card companies have been notified, and law enforcement is likewise investigating the incident. "Customers using a Sears-branded credit card were not impacted," Sears said. "In addition, there is no evidence that our stores were compromised or that any internal Sears systems were accessed by those responsible."
In a statement, [24]7 said the breach occurred on September 27th of last year and was contained roughly two weeks later. In a statement, Sears said it was first notified about the breach in mid-March. Credit card companies have been notified, and law enforcement is likewise investigating the incident. "Customers using a Sears-branded credit card were not impacted," Sears said. "In addition, there is no evidence that our stores were compromised or that any internal Sears systems were accessed by those responsible."
I didn't know Sears still had 100,000 customers.
Do you have ESP?
Sears has 100,000 customers? Wow!
Delta: Hundreds of thousands.
Sears: Tens.
I was on the Sears site today and it served up a malware ad. So now we know how much they really care about security.
We understand malware present in [24]7.ai's software between Sept. 26 and Oct. 12, 2017 made unauthorized access possible for the following fields of information; name, address, payment card number, CVV number, and expiration date during their purchase process if this information was manually entered by the customer and the customer completed the purchase transaction.
Why did it take 5 months to disclose? As a simple hypothesis, I would suggest its because disclosure in November may have had an impact on Deltas ability to generate anticipated levels of revenue in December, a major holiday travel season.
Good people go to bed earlier.
When ever I see a public notification with a large delay between when it happened and when it came out, it makes me wonder how many people working for the company shorted their stock portfolio.
Who's going to goddamn jail for this? Fuck this everyday bullshit!
I keep saying, the following penalty scheme will clean up data breaches right quick:
$1 per name, email, physical address
$2 per phone number
$3 per credit card number
$4 per SSN
And multiply for combinations thereof. You'll see how fast companies move to secure their data.
Paypal with 2fa. It's insane to type card details into a website.
"In addition, there is no evidence that our stores were compromised or that any internal Sears systems were accessed by those responsible."
Since you didn't install/activate the security that would have been able to prevent/detect or at least log any such breach, small wonder that there is no evidence.