Slashdot Mirror

← Back to Stories (view on slashdot.org)

Best Buy Warns of Data Breach (usatoday.com)

Posted by BeauHD on from the heads-up dept.

Best Buy, along with Delta Air Lines and Sears, says that [24]7.ai, a company that provides the technology backing its chat services, was hacked between September 27 and October 12, potentially jeopardizing the personal payment details of "a number of Best Buy customers." The electronics company said in a statement that "as best we can tell, only a small fraction of our overall online customer population could have been caught up in this... incident whether or not they used the chat function." They will reach out to customers who were impacted.

25 comments

  1. This is routine by silverkniveshotmail. · · Score: 2

    I'm not surprised or outraged anymore. On the bright side, credit monitoring is basically free for everyone forever.

    1. Re: This is routine by Anonymous Coward · · Score: 0

      Technically credit reports have always been shared with Pajit and Kumar somewhere in a shitty jungle call center.

    2. Re:This is routine by Anonymous Coward · · Score: 0


      This is <Credit Monitoring Service>,

        We regret to inform you that your identity was compromised at <Company Name> and we have begun our efforts to protect your credit.

      As always we thank you for being a valued customer of <Credit Monitoring Service>.

      Regards,

      <CEO Name and Signature>

      Of course once you realize that there is nothing to be gained from this relationship, as they can't prevent this from reoccuring, and it's actually yet another point of compromise for you, you start wondering why this crap isn't dealt with. Then you realize you've sold your digital soul to abunch of green-eyed marketing agents and start wishing you could put the genie back in the bottle. Finally you pucker up and bend over because short of a march on D.C. you won't get any real fix because everyone but you, that matters, is getting rich off of it.

  2. Damn it, time for a law with teeth by Anonymous Coward · · Score: 0

    This is BS. I work for the gov and can't get any IT installed without going through a long RMF process and have it continuously scanned for vulnerabilities. Any found require an immediate patch or approved mitigation. If no patch or mitigation, it needs to go away.

    These companies that can't seem to do the same should suffer the death sentence when they are breached and customer data is stolen. That data should be behind multiple firewalls and a secure enclave with no direct access. Use tokens outside the enclave to represent customers. There is no way in hell a 3rd party contractor should have any direct access to the raw data.

    I'm sure Best Buy will shrug this off with a token one year credit monitoring offer. Right now I have so many companies monitoring my credit for free I can't keep track of them all. Threaten their executive level officers and board members with jail and I bet they get damn serious about security.

    1. Re: Damn it, time for a law with teeth by Anonymous Coward · · Score: 0

      the data breach is much older, and by design.

      why would credit card details be shared with a live chat vendor? specially clients that never used chat?

      this sounds like they were caught in a payment processing offence and decided to "blame the hackers"

  3. outsource to the lowest cost provider by Anonymous Coward · · Score: 0

    and this is what happens. what else did you expect.. especially where customer data and credit cards are handled...hire a competent staff and do the shit yourself.

    ohh? that costs more money than your current method? well, your current method is fucked up and doesn't work. quit being greedy fucks, pay your staff competitively (while not overpaying your executives). hire locally (i.e. domestically), not imports from beyond the oceans.

    all this outsourcing is like just trying to pass-the-buck 'just in case' something (like this) happens.. each of the retailers can say "not our fault" and point the finger-of-blame elsewhere.

  4. There is a simple solution by Anonymous Coward · · Score: 1

    For in-store purchase, CASH!!!

    1. Re:There is a simple solution by Anonymous Coward · · Score: 0

      For in-store purchase, CASH!!!

      Mod parent up!!!!!

    2. Re:There is a simple solution by tlhIngan · · Score: 1

      For in-store purchase, CASH!!!

      Except it wasn't in-store purchases that were hacked. It was online purchases - the chat software was a SaaS package Best Buy, Sears, etc. all used that got hacked.

      It's not about Point of Sale machines being hacked (this time), but how one company has software used by lots of other companies got hacked. Closest example would be bad ads being served up, except instead of the site hosting the ad, it was a piece of utility software instead.

  5. Monotonous! by mschaffer · · Score: 2

    Let me know when someone hasn't been breached.
    The real news is that nothing important is being done about it.
    Nobody gets punished. Nothing happens except waiting for the next one.

    1. Re: Monotonous! by ArmoredDragon · · Score: 1

      Hmm...no. I know for a fact that they're going to get fined by PCI. PCI-DSS is in many ways like HIPAA: It gives vague details about how your network and servers should be secured, (for example it says networks should be "segmented" with no clarification at all if vlans suffice) and basically "do your best". If payment details get leaked, then guess what? You didn't do enough to secure your network, so have a fine.

      Though PCI also has a reputation of being in the business of fining anyone who processes credit cards. If they don't have a reason to fine you, then they might create one by saying you weren't following one of their vague rules, even if there hasn't been a data breach. This is why a lot of businesses prefer to use a company like square to process the payment data. Best buy isn't one of those, however, because they store their own credit card data.

  6. Why? by srichard25 · · Score: 2

    Why would technology backing chat need any access to payment information?

    1. Re:Why? by Anonymous Coward · · Score: 0

      The same machines probably have access to the payment systems so that the chat customer service rep can actually do useful work for customers :p

    2. Re: Why? by Anonymous Coward · · Score: 0

      It runs as java script on the browser and sends any button clicks and form data to the âoeanalyticsâ channel in the âoechatâ company

    3. Re:Why? by tlhIngan · · Score: 1

      Why would technology backing chat need any access to payment information?

      The problem was the chat software was hacked. So when you try to check out and enter your payment information, that little box that pops up asking if you need support then snarfs the data from the web page.

      Basically, all these companies use a SaaS package from a company who was breached. That breach caused the software used to get the ability to steal information. It's less about Best Buy et al. storing the payment information, and more of a rogue script in a SaaS package they use grabbing the data in flight.

      There's probably way more companies who are going to find out they were customers of [24]7 as well.

  7. Oof! by Anonymous Coward · · Score: 0

    "All 6 people who still shop at Best Buy were affected by the breach."

  8. How to keep your information from being compromise by Hallux-F-Sinister · · Score: 1

    Donâ(TM)t ever tell your personal information to anyone. Thatâ(TM)s the closest way you can come to protecting it. Itâ(TM)s just the reality today, and itâ(TM)s why we canâ(TM)t have nice things. Itâ(TM)s too late for me, as everyone on the dark web knows everything about me... I may have to give up all my stuff, and learn how to speak Amish.

    --
    Our reign has gone on long enough. Indeed. Summon the meteors.
  9. Data breaches are like old, rusty cars. by Anonymous Coward · · Score: 0

    It's always worse than you first think.

    Anyone who has restored an old car knows this.

  10. Don't let them keep or store your info.. by Anonymous Coward · · Score: 0

    Don't let them have your payment info??

  11. Who ya gonna call to clean up a mess like this? by SpzToid · · Score: 1

    Geek Squad!

    The FBI paid Best Buy Geek Squad employees as informants, rewarding them for flagging indecent material when people brought their computers in for repair.

    --
    You can't be ahead of the curve, if you're stuck in a loop.
  12. Re:How to keep your information from being comprom by Ol+Olsoc · · Score: 1

    I may have to give up all my stuff, and learn how to speak Amish.

    It's similar to English Canadian. Now let's get you a name - Caleb has a nice ring.

    But it isn't all bad, if google searches for "Amish Porn" are any indication.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  13. TRANSLATION by JustAnotherOldGuy · · Score: 1

    "as best we can tell, only a small fraction of our overall online customer population could have been caught up in this... incident"

    Lol, "as best we can tell"

    TRANSLATION: "They got all your data, every bit of it, but we're going to reveal this in a series of press releases in order to desensitize you to the scope of the loss."

    --
    Just cruising through this digital world at 33 1/3 rpm...
  14. hardly a punishment by Anonymous Coward · · Score: 0

    PCI fines are usually very small. For example, TJ Maxx only paid $500k. This is small potatoes when compared to what their earnings are.

    1. Re:hardly a punishment by Anonymous Coward · · Score: 0

      They are also paid to the government, not the victims.

  15. Key Shadowing by Anonymous Coward · · Score: 0

    As long as key management systems exist this will only keep happening! Quantum computing is around the corner. The only tech that can help this situation is www.keyshadowing.com if it's about risk management then why do we still store keys sitting there waiting to be lost, or stolen. Get rid of it that way it eliminates that risk. Also, that tech is the only tech in the world Quantum immune.