Attacks/Breaches
12/22/2010
01:35 PM
Connect Directly
RSS
E-Mail
50%
50%

100,000 Credit Cards Compromised By Data Breach

CitySights NY tour operator was storing card security codes in apparent violation of payment card industry regulations.

A data breach affecting Twin America, the parent company of CitySights NY, potentially compromised an estimated 100,000 customers' personal details, including credit card numbers.

According to a security breach notification letter sent to the New Hampshire attorney general, as required by that state's laws, attackers successfully exploited a Twin America Web server by using a SQL injection attack.

The letter, written by Twin America's lawyer, Theodore Augustinos, said that Twin America first suspected its systems had been breached in late October, "when a Web programmer discovered [an] unauthorized script that appears to have been uploaded to the company's Web server." The script appeared to have been actively siphoning off sensitive information from a database stored on the server for about four weeks before being discovered.

According to the letter, dated Dec. 9, "the database contained cardholder name, address, e-mail address, credit card number, expiration date, and CVV2" information. Given that the tour operator had to issue a data breach notification, it appears that the information wasn't encrypted, as that typically exempts an organization from having to issue a data breach notification.

But storing CVV2 -- card verification -- data would put the company in violation of the Payment Card Industry Data Security Standard (PCI DSS), which expressly forbids merchants from storing CVV2 data, even in encrypted form, once a transaction has been authorized by a credit or debit card provider.

Interestingly, 1,850 Massachusetts residents were also affected by the breach, which could make it the first test of that state's recently enacted data breach laws, which are amongst the toughest in the nation. According to antivirus vendor Kaspersky Labs' Threatpost, the state's law, known as 201 CMR 17, "requires organizations that store personal information on Massachusetts' residents to encrypt personal information at rest -- in databases, servers, laptops, desktops, mobile devices," as well as "data transmitted over wired or wireless networks." Violators may be hit with fines or lawsuits filed by the state's attorney general.

According to the Identity Theft Resource Center (ITRC), so far in 2010 there have been 654 publicly reported breaches in the United States which collectively exposed more than 16 million records. That puts the year on track to record many fewer breaches than in 2009, when the ITRC saw 222 million records potentially comprised. On the other hand, just two large breaches accounted for 200 million of those records.

But counting breaches is an inexact science. For starters, numerous data breaches go unreported, despite state laws to the contrary. The ITRC also said that in 2009, more than half of all companies that publicly disclosed they'd been breached didn't specify the number of people who might have been affected.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio