Attacks/Breaches
12/22/2010
01:35 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

100,000 Credit Cards Compromised By Data Breach

CitySights NY tour operator was storing card security codes in apparent violation of payment card industry regulations.

A data breach affecting Twin America, the parent company of CitySights NY, potentially compromised an estimated 100,000 customers' personal details, including credit card numbers.

According to a security breach notification letter sent to the New Hampshire attorney general, as required by that state's laws, attackers successfully exploited a Twin America Web server by using a SQL injection attack.

The letter, written by Twin America's lawyer, Theodore Augustinos, said that Twin America first suspected its systems had been breached in late October, "when a Web programmer discovered [an] unauthorized script that appears to have been uploaded to the company's Web server." The script appeared to have been actively siphoning off sensitive information from a database stored on the server for about four weeks before being discovered.

According to the letter, dated Dec. 9, "the database contained cardholder name, address, e-mail address, credit card number, expiration date, and CVV2" information. Given that the tour operator had to issue a data breach notification, it appears that the information wasn't encrypted, as that typically exempts an organization from having to issue a data breach notification.

But storing CVV2 -- card verification -- data would put the company in violation of the Payment Card Industry Data Security Standard (PCI DSS), which expressly forbids merchants from storing CVV2 data, even in encrypted form, once a transaction has been authorized by a credit or debit card provider.

Interestingly, 1,850 Massachusetts residents were also affected by the breach, which could make it the first test of that state's recently enacted data breach laws, which are amongst the toughest in the nation. According to antivirus vendor Kaspersky Labs' Threatpost, the state's law, known as 201 CMR 17, "requires organizations that store personal information on Massachusetts' residents to encrypt personal information at rest -- in databases, servers, laptops, desktops, mobile devices," as well as "data transmitted over wired or wireless networks." Violators may be hit with fines or lawsuits filed by the state's attorney general.

According to the Identity Theft Resource Center (ITRC), so far in 2010 there have been 654 publicly reported breaches in the United States which collectively exposed more than 16 million records. That puts the year on track to record many fewer breaches than in 2009, when the ITRC saw 222 million records potentially comprised. On the other hand, just two large breaches accounted for 200 million of those records.

But counting breaches is an inexact science. For starters, numerous data breaches go unreported, despite state laws to the contrary. The ITRC also said that in 2009, more than half of all companies that publicly disclosed they'd been breached didn't specify the number of people who might have been affected.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web