Attacks/Breaches

6/4/2010
04:54 PM
50%
50%

Digital River Sues Over Theft Of Data On Nearly 200,000 Customers

New York man allegedly attempted to sell data that may have been stolen by hackers in India

E-commerce company Digital River has filed suit against a 19-year-old New York man who allegedly attempted to sell a list of nearly 200,000 of its customers to a Colorado marketing firm for $500,000.

According to a news report in the Minneapolis Star-Tribune, Digital River obtained a secret court order last month to block Eric Porat of Brooklyn from selling, destroying, altering, or distributing the customer data. Digital River suspects that the information was stolen by hackers in New Delhi, India, possibly with help from a contractor working for Digital River.

Porat has said he got the information from India, but won't say how or from whom, the report says.

"I fully suspect that Mr. Porat hacked the hacker," said Christopher Madel, an attorney with Robins, Kaplan, Miller, and Ciresi who's overseeing Digital River's investigation.

Digital River filed the lawsuit under seal on May 13 listing Porat and his company, Affiliads, as defendants and demanding to know how they obtained Digital River's data and what they've done with it.

The data was originally gathered by companies that offer "affiliated marketing" programs, a practice in which businesses pay a commission to affiliates who post links on the Internet that drive customers to participating companies, the report says.

Porat allegedly tried to sell the data to direct marketing firm Media Breakaway, which initially turned him down, according to the report. When he persisted, Media Breakaway reported Porat and agreed to help the FBI and Digital River to track him down.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.