Attacks/Breaches
12/22/2010
01:35 PM
50%
50%

100,000 Credit Cards Compromised By Data Breach

CitySights NY tour operator was storing card security codes in apparent violation of payment card industry regulations.

A data breach affecting Twin America, the parent company of CitySights NY, potentially compromised an estimated 100,000 customers' personal details, including credit card numbers.

According to a security breach notification letter sent to the New Hampshire attorney general, as required by that state's laws, attackers successfully exploited a Twin America Web server by using a SQL injection attack.

The letter, written by Twin America's lawyer, Theodore Augustinos, said that Twin America first suspected its systems had been breached in late October, "when a Web programmer discovered [an] unauthorized script that appears to have been uploaded to the company's Web server." The script appeared to have been actively siphoning off sensitive information from a database stored on the server for about four weeks before being discovered.

According to the letter, dated Dec. 9, "the database contained cardholder name, address, e-mail address, credit card number, expiration date, and CVV2" information. Given that the tour operator had to issue a data breach notification, it appears that the information wasn't encrypted, as that typically exempts an organization from having to issue a data breach notification.

But storing CVV2 -- card verification -- data would put the company in violation of the Payment Card Industry Data Security Standard (PCI DSS), which expressly forbids merchants from storing CVV2 data, even in encrypted form, once a transaction has been authorized by a credit or debit card provider.

Interestingly, 1,850 Massachusetts residents were also affected by the breach, which could make it the first test of that state's recently enacted data breach laws, which are amongst the toughest in the nation. According to antivirus vendor Kaspersky Labs' Threatpost, the state's law, known as 201 CMR 17, "requires organizations that store personal information on Massachusetts' residents to encrypt personal information at rest -- in databases, servers, laptops, desktops, mobile devices," as well as "data transmitted over wired or wireless networks." Violators may be hit with fines or lawsuits filed by the state's attorney general.

According to the Identity Theft Resource Center (ITRC), so far in 2010 there have been 654 publicly reported breaches in the United States which collectively exposed more than 16 million records. That puts the year on track to record many fewer breaches than in 2009, when the ITRC saw 222 million records potentially comprised. On the other hand, just two large breaches accounted for 200 million of those records.

But counting breaches is an inexact science. For starters, numerous data breaches go unreported, despite state laws to the contrary. The ITRC also said that in 2009, more than half of all companies that publicly disclosed they'd been breached didn't specify the number of people who might have been affected.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8617
Published: 2015-03-04
Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/re...

CVE-2015-2209
Published: 2015-03-04
DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.

CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.