Attacks/Breaches
12/22/2010
01:35 PM
Connect Directly
RSS
E-Mail
50%
50%

100,000 Credit Cards Compromised By Data Breach

CitySights NY tour operator was storing card security codes in apparent violation of payment card industry regulations.

A data breach affecting Twin America, the parent company of CitySights NY, potentially compromised an estimated 100,000 customers' personal details, including credit card numbers.

According to a security breach notification letter sent to the New Hampshire attorney general, as required by that state's laws, attackers successfully exploited a Twin America Web server by using a SQL injection attack.

The letter, written by Twin America's lawyer, Theodore Augustinos, said that Twin America first suspected its systems had been breached in late October, "when a Web programmer discovered [an] unauthorized script that appears to have been uploaded to the company's Web server." The script appeared to have been actively siphoning off sensitive information from a database stored on the server for about four weeks before being discovered.

According to the letter, dated Dec. 9, "the database contained cardholder name, address, e-mail address, credit card number, expiration date, and CVV2" information. Given that the tour operator had to issue a data breach notification, it appears that the information wasn't encrypted, as that typically exempts an organization from having to issue a data breach notification.

But storing CVV2 -- card verification -- data would put the company in violation of the Payment Card Industry Data Security Standard (PCI DSS), which expressly forbids merchants from storing CVV2 data, even in encrypted form, once a transaction has been authorized by a credit or debit card provider.

Interestingly, 1,850 Massachusetts residents were also affected by the breach, which could make it the first test of that state's recently enacted data breach laws, which are amongst the toughest in the nation. According to antivirus vendor Kaspersky Labs' Threatpost, the state's law, known as 201 CMR 17, "requires organizations that store personal information on Massachusetts' residents to encrypt personal information at rest -- in databases, servers, laptops, desktops, mobile devices," as well as "data transmitted over wired or wireless networks." Violators may be hit with fines or lawsuits filed by the state's attorney general.

According to the Identity Theft Resource Center (ITRC), so far in 2010 there have been 654 publicly reported breaches in the United States which collectively exposed more than 16 million records. That puts the year on track to record many fewer breaches than in 2009, when the ITRC saw 222 million records potentially comprised. On the other hand, just two large breaches accounted for 200 million of those records.

But counting breaches is an inexact science. For starters, numerous data breaches go unreported, despite state laws to the contrary. The ITRC also said that in 2009, more than half of all companies that publicly disclosed they'd been breached didn't specify the number of people who might have been affected.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.