Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Privacy Data Storage Your Rights Online

Lost Credit Data Improperly Kept, Company Admits 272

Posted by timothy from the just-researching-your-privacy-loss-tolerance dept.
Zak3056 writes "Last week, Mastercard announced that up to 40,000,000 credit card numbers may have been compromised by one of their processing companies. Today, the New York Times (registration, along with first born child, required) is reporting that the company in question, CardSystems Solutions, should not have been retaining that data to begin with. John M. Perry, CEO of the processor in question, claims the data was merely being kept for 'research purposes.' The number of compromised Master Card accounts has been revised downward to about 68,000, with another 132,000 possibly compromised accounts belonging to Visa, American Express, and other companies."
This discussion has been archived. No new comments can be posted.

Lost Credit Data Improperly Kept, Company Admits More

Lost Credit Data Improperly Kept, Company Admits

Comments Filter:

  • Slight difference? (Score:5, Interesting)

    by jez9999 ( 618189 ) on Monday June 20, 2005 @05:51PM (#12867144) Homepage Journal
    Am I reading this correctly? 40 million down to just over 60 thousand? I mean, if the latter figure is correct, this is a MUCH different (less major) story.

    • Re:Slight difference? (Score:5, Insightful)

      by Tuxedo Jack ( 648130 ) on Monday June 20, 2005 @05:54PM (#12867169) Homepage
      Even so, the issue is that it was still improperly retained - and that corporate America isn't giving a damn about security for the average joe's accounts and such.

      • Re:Slight difference? (Score:5, Interesting)

        by alan_dershowitz ( 586542 ) on Monday June 20, 2005 @06:14PM (#12867325)
        Well, that's kind of true and kind of not. The credit card companies are a few days from requiring vendor compliance with a strict standard for credit card information processing and storage. Basically, if you are not implementing this security standard, you will not be able to use credit cards in your place of business. (this is for online businesses and Point of Sale service providors, not like restaurants and stuff.)

        CISP and PCI compliance [visa.com]

        If data in a vendor's system is compromised, Visa and Mastercard will charge fines upward of a hundred thousand dollars per violation, and by the time a third violation occurs, your place of business may be denied use of credit card services permanently.

        That's a good thing for everyone, but when crap like this happens it pisses me off. Credit Card companies are (correctly) requiring the strictest standards for storing cardholder data by vendors, but at the same time they themselves are losing 40 million cardnumbers, losing unencrypted backup tapes in shipping, etc. What pisses me off is that if I screw up and lose a credit card number into the wild, I get fined 100K. If they lose 40 million cards, what are they gonna do, fine themselves?

        • What pisses me off is that if I screw up and lose a credit card number into the wild, I get fined 100K. If they lose 40 million cards, what are they gonna do, fine themselves?

          Exactly. And that, in my opinion, is why identity theft and similar crimes are still such a huge issue. The banks are not liable for the loss. The consumer or the merchant gets stuck with the loss (the consumer does have some legal protections).

          If someone gets a fake card in your name, or steals your card, the merchant usually ends u

        • If they mandate such strict standards and fines, IMHO their business would take a HUGE hit. There are LOTS of small businesses out there that can't meet that standard, as well as large businesses. The small business that Mom & Pop run or the craft shows both of which are several Billion dollars in sales, I can't see Visa giving that up but I can see the merchants giving up Visa. The problems have NOT been with the retail merchant but with the clearing houses. So why does Visa want to punish the small en
        • The credit card companies are a few days from requiring vendor compliance with a strict standard for credit card information processing and storage

          Really? We handle a *lot* of credit card transactions every day, and I've never heard of this. All I got was a 20 page brochuse with *tiny* type when I first got a merchant account years ago. Security? Ha! Do you know what is supposed to happen with signed credit card receipts? No? Me neither! Ask any retailer... nobody knows! Data stored on computers
      • if card solutions is acting like a RICO outfit, treat 'em like a RICO outfit. shut 'em down and auction off the office chairs for reimbursement.

        keep no numbers, folks, pass 'em or bilge 'em.
      • Even so, the issue is that it was still improperly retained
        No it was being kept for "research purposes" - which is an excuse that works for whale hunting so why not try it for keeping credit card data you shouldn't have?

        Aren't there crimianal charges that should apply in the USA? There are laws in in other countries to penalise this sort of behaviour.

        • I'd expect that to be illegal under privacy laws.

          Certainly wouldn't be allowed over here (it's illegal to pass on such data without explicit permission, and even then the DPR can turn around an fine you if you had no legitimate use for the data in the first place).

    • Re:Slight difference? (Score:3, Insightful)

      by trmj ( 579410 )
      The 68k were cards issues by MasterCard alone, with another 132k cards issued by other companies.

      This is still an apporximation, but a much nicer one than the 40 million that were "potentially" compromised originally.

      Yes, it's still completely intolerable for this to have happened, as the processor shouldn't store that data any longer than it takes to process the charge.

      At least Mastercard is stepping up and taking control of this situation, I haven't seen a story about the other companies taking a

      • Re:Slight difference? (Score:3, Informative)

        by syukton ( 256348 )
        From TFA:
        MasterCard said Saturday that 68,000 of its own account numbers were especially at risk because they were in a file found to have actually been "exported from the system."

        In other words, 68,000 numbers were in a file exported from the system, but the system still contained 40 million credit card numbers from different credit card companies (Mastercard, Visa, American Express, etc).
    • No these idiots were completely hacked. The only thing they know for certain is that the files they were illegitimately retaining were unprotected and thus vulnerable duing the break in. But someone who could compromise them that badly might very well have been intercepting all the transactions they did not retain. Since these folks think vb scripts are good protection they are probably clueless about security and assessing intrusion.

  • No Reg Link (Score:5, Informative)

    by OverlordQ ( 264228 ) on Monday June 20, 2005 @05:52PM (#12867150) Journal
    I'm sure it's been mentioned every time a NYT article is posted, but use the NYT Link Generator [blogspace.com] .

    Btw, NoReg for this article [nytimes.com].

  • Credit Card Doublespeak (Score:5, Informative)

    by Qzukk ( 229616 ) on Monday June 20, 2005 @05:52PM (#12867154) Journal
    "The number of compromised Master Card accounts has been revised downward to about 68,000, with another 132,000 possibly compromised accounts belonging to Visa, American Express, and other companies."
    Should be read as
    "The number of compromised Master Card accounts from accountholders in California where we actually have to report this is about 68,000. Another 132,000 people in California with Visa, American Express, and other credit card companies' cards also had their account information taken"
    • "The number of creditcard holders rich enough to sue our asses off if we don't report it to them AND who have a good idea that we're to blame if any problem occurs is 68,000. Of the rest, either they don't care or we don't."

      Remember, although only 68,000 cards had the necessary secondary information on that site to exploit, that secondary information may otherwise be available. It just won't be provable that it's this company's fault.

      Personally, I'd like to see a new law introduced, in which the loss o

  • in that case... (Score:2, Funny)

    by Anonymous Coward
    the data was merely being kept for "research purposes."

    well, that makes it ok then. NOT!

  • this is not an error (Score:5, Funny)

    by nilbog ( 732352 ) on Monday June 20, 2005 @05:53PM (#12867164) Homepage Journal
    This isn't an error at all, it's actually a *feature* of your credit card agreement. Gets your card number out there so you don't have to bother giving it to retailers - they already have it!

    • ...are horrendously obsolete and insecure.

      We should be allowed to tell the store guy "I'll give you credit online." We should be able, within a reasonable period, to go home and specify the store to give credit to, along with the credit needed.

      Example: I want the latest pair of Nikes. I'd try my size on, and tell the store clerk I want to pay with credit. He'd give me a voucher with a unique code that can be used to give him credit (a bit like wiring money).

      Within 7 days (a month if it was a car or

      • In Sweden, there is something called e-kort [www.fsb.se], available at Föreningssparbanken and at least one more bank (don't remember exactly which one though).

        Basically, it's a service from the bank, giving you the opportunity to create disposable one time, amount limited, credit card numbers, with a shorter than normal expiry time. More or less does exactly what you want, but in a totally different way... :) Backside: Only works for online purchases, unfortunately. OTOH, this is /. so there isn't really any re

      • You would have to go home and authorize it.

        Doesn't really help with impulse buying.

        Personally, I think all credit card transactions should be PIN based rather then simply signature.

        Then lets get wild...

        Let's increase the digits a bit in length? Now, card numbers are issued every six months? Or if you want to opt for an online-only card #. You can get a new one every month or two months.

        I really hate keeping the same card number for years. It almost gurantees that some asshat will store my data and get
        • You would have to go home and authorize it. Doesn't really help with impulse buying.

          You would have to auth it at home, BUT you'd be able (to a reasonable extent, barring weight limits, and purchases people obviously can't afford) to exceed the credit limit, albeit with a small fee as usual. Since the vendor gets no credit card number (only a voucher showing that the specific purchase was paid for, if it is paid for), they won't know how close to the limit the purchaser is.

          As long as the purchaser wire

    • Gets your card number out there so you don't have to bother giving it to retailers - they already have it

      First of all, the hacked system in question belonged to a payment processor, not a merchant. Second, merchants already do keep them. Walmart's central data warehouse has a consumer's entire transaction, including credit card number, within 15 minutes of the POS transaction. I went to Home Depot to make a return without a receipt and with a swipe of my cc the cashier had the transaction on screen in
      • Walmart's central data warehouse has a consumer's entire transaction, including credit card number, within 15 minutes of the POS transaction. I went to Home Depot to make a return without a receipt and with a swipe of my cc the cashier had the transaction on screen in just a couple of seconds. Scary! Cash at HD from now on for me!

        They may only actually keep a hash of your credit card number & expiration date. When they swipe your card the second time they just search for a matching hash, which means

      • So you made a return without a receipt, and they were able to pull up your transaction to make the return without a problem... and you want to forfeit that?

        Security is fine and all, but I really like convenience, and I really like that when someone screws up, my bank fixes it. They can go hand in hand.
  • We got a call today from Amex about our card possibly having unauthorized use at DunkinDonuts.com

    Funny thing is we would probably shop there. All nicotine and caffeine diet and all.

  • Lawsuit (Score:5, Interesting)

    by fdiskne1 ( 219834 ) on Monday June 20, 2005 @05:58PM (#12867193)
    Can you say "lawsuit"? This was a total lapse in judgement in keeping data they shouldn't have compounded with the fact that they didn't secure their network. I'd place money on this company not surviving this error. Even if the loss of money in settlements doesn't break them, I'd bet they will lose most of their future business because of this (and rightly so).

  • Newly revised figures... (Score:4, Funny)

    by yotto ( 590067 ) on Monday June 20, 2005 @05:58PM (#12867196) Homepage
    I just heard that they revised the numbers again. Now it appears that the lost data is actually just 4 credit cards. And they're all Fashion Bug cards so it would be really easy to spot them if they were used illegally.

  • This isn't working out.. (Score:5, Insightful)

    by aero2600-5 ( 797736 ) on Monday June 20, 2005 @06:00PM (#12867210)
    Apparently, keeping credit card numbers secure isn't working out. Why? Because it's just a number. The major credit companies need to revise how the whole credit system works. If they assume that everyone knows everyone else's credit card number by default, they should be able to devise a system a hell of a lot more secure than some 16 digit number. Your credit card number has to be retained by anyone you do business with so that they know who you are. Credit card security needs some major improvements, like a passphrase, password, or even a PIN. A 4-digit PIN would make a world of difference, but if you're going to fix it, you should fix it right. A passphrase would be best. Something that's communicated when the authorization is taking place, checked against a nice secure server, and then is forgotten and not retained. The fact that a system of this nature is not yet in place just shows that the major credit card companies just don't give a shit.
    /end rant

    Aero

    • Re:This isn't working out.. (Score:5, Insightful)

      by bracher ( 33965 ) on Monday June 20, 2005 @06:08PM (#12867286)
      I agree that something more secure than a 16-digit number is certainly feasible and needed. But it shouldn't be something that needs to be passed through a third party. The card should be a smart card capable of signing a transaction, and only the signature should be transmitted.

      Something that's communicated when the authorization is taking place, checked against a nice secure server, and then is forgotten and not retained.

      The essential point you're missing here is that, currently, your 16-digit card number _is_ this something. The core of the problem (this time at least) is that the processing company wasn't following those rules. What keeps them from holding on to your passphrase for 'analysis'?
      • I agree that something more secure than a 16-digit number is certainly feasible and needed. But it shouldn't be something that needs to be passed through a third party. The card should be a smart card capable of signing a transaction, and only the signature should be transmitted

        You mean like this [chipandpin.co.uk]?

        Most retailers in the UK now have terminals where you punch in your PIN at point of sale. Has that made it across the pond yet?

        Only problems I can see - I can see it resulting in an increase in ATM muggings,
        • Nope.

          4 digit pin.. any twit can watch you type 4 digits and memorize it. Why not 10? 20? A wasted opportunity to increase security IMO.

          The terminals that the retailers use have *no* attempt at security (hand covers etc.) so the above becomes not only possible but likely.

          Also, You're typing in public the same PIN that gives you ATM access to your entire bank account - and may of the standalone ATMs do *not* verify using the smartcard, meaning that duplication is more likely not less.

          Plus the change in
    • So, sort of like a Debit card, then. Like are used heavily in most of Europe and Canada.

    • Re:This isn't working out.. (Score:5, Insightful)

      by Stonehand ( 71085 ) on Monday June 20, 2005 @06:11PM (#12867314) Homepage
      Well, judging by the article, Mastercard specifically told the processor *not* to retain information -- and the latter did, anyway. The policy already existed.

      No, to block things you'd need to do more than tell them not to retain information. You'd need to make sure that even if they did, it was useless. This might point towards requiring people to generate one-time passwords, which would probably be a fair expensive.
    • I've been saying this for years. Credit card companies act as if your card is secure just because you (usually) have to sign the slip when you use it. A signature does not make a card secure, especially when the users' signature is on the back of it so anyone can practice forging it. Why did they not start assigning PINs to credit cards years ago?

    • Re:This isn't working out.. (Score:4, Insightful)

      by spood ( 256582 ) on Monday June 20, 2005 @06:35PM (#12867449) Homepage Journal
      Credit card fraud is not a technical problem. Using the old adage, we cannot apply a technical solution. All of the extra verification proposed implies an added cost that will still not solve the problem - if you require a passphrase or some secondary authentication, thieves will just steal the second factor as well.

      The best solution is to shift the responsibility for fraud to those that are responsible for allowing it - the merchants who process card transactions. This is how it is already done, and the fact that plenty of merchants still do business with credit cards proves that the system works, despite the fact that CC companies don't "give a shit."

      As a consumer, I'd be perfectly fine with everyone knowing my credit card number because I'm not responsible for fraudulent purchases by law. This is a system that works.

      What you should really be upset about it is the system that allows identity theft to run rampant. Though the two are related, there is a fundamental difference between someone else using a credit card you've established in your name and someone else using a credit card that they've established in your name.

      The current system is much weaker against this type of activity because the burden of responsibility for fraud is still heavily on the consumer rather than the parties that allow identity theft to be profitable (mainly banks, but to a lesser extent any industry that relies on credit reporting). The solution to this problem is not so clear.

      • Credit card fraud is not a technical problem. Using the old adage, we cannot apply a technical solution. All of the extra verification proposed implies an added cost that will still not solve the problem - if you require a passphrase or some secondary authentication, thieves will just steal the second factor as well.

        This credit card account theft would not have occurred if we used smart cards capable of public key cryptography instead of numbers/passwords/passphrases/etc to authenticate our financial tr

    • I think what you really want is public key digital signatures. You can get smart cards now that do 2048 bit RSA. Why trust the credit card companies to not store private information when the technology exists to authenticate your transactions without divulging any private information whatsoever?
    • What if you where to use one of those RSA key card. You know the one where the number is only valid for 90 seconds. That matched with a password or pin it Authenticates you at that POS and you since its only valid for 90 Seconds they can't keep track of your card number.

  • NYT ?? What gives (Score:5, Informative)

    by Rac3r5 ( 804639 ) on Monday June 20, 2005 @06:00PM (#12867217)
    I don't wanna be a troll here, but please, there are a dozen other sites that have the same article. Do we have to rely on a site that requires u to log in?
    http://www.internetnews.com/security/article.php/3 513866/ [internetnews.com]
    • I didn't have to log in. The ratilce just appeared when I clicked. I'm not registered with the Times, as far as I can recall.
    • NPR had a good piece on this I caught on the radio this morning.

      link [npr.org] (realaudio, wmp)

      ...what's really disturbing is how much we don't know ... they were storing names, addresses, credit card numbers, and the three digit security code on the back of the card...
  • Let's face it, credit cards have never been save and will never be save!

    It's the price you have to pay for the convenience credit cards offer.
    • Being so widely accepted, it'd be nice if we could just change cards to be more secure.
    • Credit cards never have been safe, but that doesn't mean that they can't ever possibly be safe.

      There are ways to do secure payments, usually involving cryptography. Generally, it works like a "digital check" where you create an authorization for a payment, digitally sign and date it, and then hand it over. They never have access to your credit card number, because the real secret is your private key, which never leaves your PDA/smart card/phone/etc. Your bank ensures that the "check" is only cashed once,
      • I've heard that the majority of merchants that accept Visa still take mechanical impressions and mail them in, due to lack of any reliable electronic communication. Not the majority of transactions, by any means, but still. Your system would have to account for this.

        The current system boils down to: it's the merchant's problem if there's fraud. Your liability is quite limited. Before identity theft was common this was a fine system.
  • Are we hearing about this more, or is it happening more?

    • Re:What's the deal here? (Score:3, Informative)

      by sfjoe ( 470510 )
      Are we hearing about this more, or is it happening more?

      We're hearing about it more because California passed a new law requiring disclosure of privacy breaches. California citizens get notified and that opens the story to the news media.
      By the way, this is the same California that the conservatives love to bash for being "anti-business".

      You're welcome.

  • It's like the commercials (Score:5, Funny)

    by jim_v2000 ( 818799 ) on Monday June 20, 2005 @06:01PM (#12867224)
    Internet connection - $30
    Homemade Computer - $700
    2 Liters of Mountain Dew - $2

    Stealing 40 Million people's credit card information with your 1337 h@x0r s|i77z - Priceless.

    There's somethings that money can't buy, but for everything else, there's MasterCard.

  • Not Surprising (Score:5, Interesting)

    by ravenspear ( 756059 ) on Monday June 20, 2005 @06:01PM (#12867230)
    It makes sense that the companies that are retaining CC data improperly would be the ones most likely to allow it to be compromised.

    The security of the data is nothing more than a second thought to many of these companies. If they feel they can keep around a huge data mine of everyone's data they can get their hands on, in violation of the proper procedures, it should come as no surprise that they wouldn't be that vigilant in securing it properly.

  • Support legislation making this a crime. (Score:5, Interesting)

    by Bamfarooni ( 147312 ) on Monday June 20, 2005 @06:02PM (#12867235)
    Once again, evidence that there should be criminal penalties for improper handling of personal information. If you collect it, you better make sure it's safe. Otherwise, stop collecting it.
    • In the UK it is already a crime under the 1988 Data Protection Act, under the heading of recklessly disclosing personal information.

      Thats why this never happens in the UK.
    • Once again, evidence that there should be criminal penalties for improper handling of personal information.

      In this case I would be *very* surprised if this company isn't on the receiving end of a stack of negligence lawsuits from the companies that had to cover the loss from transactions affecting the compromised accounts. If they were wrongfully retaining the data in the first place (and the rules against retention would be in place specifically to prevent the type of damage that has arisen), the success

  • So, there's a new name for a file? (Score:4, Informative)

    by RealAlaskan ( 576404 ) on Monday June 20, 2005 @06:04PM (#12867255) Homepage Journal
    "We should not have been doing that," Mr. Perry said. "That, however, has been remediated."

    Translation: ``We've come up with some fiction which will let us maintain plausible deniability next time we lose data we shouldn't have had in the first place.''

    As for the sensitive data, he added, "We no longer store it on files."

    Translation: ``We're going to come up with some nifty new word to replace the word `file', so we can truthfully say that we no longer have your data in our files.''

    More seriously, it makes good sense to me that they were retaining data for research purposes. They'd be irresponsible not to, just as surely as they were irresponsible not to have an air gap between that data and the internet.

  • Why isn't there one company that isn't this stupid (Score:3, Insightful)

    by CosmeticLobotamy ( 155360 ) on Monday June 20, 2005 @06:04PM (#12867256)
    I'm on the run from the feds so I couldn't register and read the article, but their excuse is that they were keeping it for research purposes? Seriously? That's the best they could come up with? "Oops" is better than "we were keeping it for research purposes." 'Cause I'm pretty sure none of your customers are going to be happy that you're being negligent with the thing that gives people access to huge amounts of their money so you can keep track of how much toilet paper they buy.
    • Presumably there are companies that aren't this stupid. This was one credit card processing company; there are hundreds of corporations in the industry.

      The issue is that malicious hackers don't go after the processors which are well protected, and a story like "Responsible Company Follows Security Guidelines; Doesn't Get Hacked" probably won't make it to the front page of the NYT.

      (or /., for that matter)

  • Time for a new system (Score:4, Insightful)

    by lawpoop ( 604919 ) on Monday June 20, 2005 @06:05PM (#12867258) Homepage Journal
    It's time for a new system. This credit card BS is getting ridiculous. Credit card numbers are easy to hack/steal, so cc comapnies start asking for address verification, or for that 3-digit 'security' code on the back. Now, address and security code information are being stolen.

    We need a new system based on PGP or something. A system where we have single-use transaction numbers, and you have give a PGP signature for each usage of a transaction number. Right now it's way to easy for hackers to steal credit card information, or for unethical merchants to make unauthorized charges. We need to put the consumer back in charge of their own finances.

    Currently , any 'merchant' can charge whatever they want once they have your credit card number. Sure, you can issue a chargeback or contest the charges, but why should *you* have to clean up after someone messes with your account? It's ridiculous.

    • Right now it's way to easy for hackers to steal credit card information, or for unethical merchants to make unauthorized charges. We need to put the consumer back in charge of their own finances.

      So what, you have $50 max liability by law but Visa and the other cc guys guarantee no liability. You know how easy it is to dispute charges? Here's what happens when someone steals your credit card. You get a call, "hi this is so and so from chase visa fraud department. We detected fraud like behavior. Can yo

  • Bullshit Flag.. (Score:2, Insightful)

    by aero2600-5 ( 797736 )
    "The number of compromised Master Card accounts has been revised downward to about 68,000, with another 132,000 possibly compromised accounts belonging to Visa, American Express, and other companies."

    Is that so? I'm going to have to throw the bullshit flag on this one. Any numbers that add up to a nice round number like '200,000' are complete crap that someone pulled directly out of their arse.

    I'm sorry, but I just don't buy it. I say they don't have a fucking clue how many numbers were exposed.

    Aer

  • Tougher privacy laws. (Score:4, Insightful)

    by Goalie_Ca ( 584234 ) on Monday June 20, 2005 @06:06PM (#12867265)
    People have to realize that privacy isn't just some criminal's ideal to keep from getting caught. If the data is out there it will be seen, hacked, sold and abused.
    • Also, "if the data is out there" even the best privacy policies won't protect it. As in this case, it takes only a single fool to ignore the policies for security of the data to tumble down like a house of cards.

      As its been said: The best-laid plans of mice and men often go awry.
  • For those people who pay attention to the news, 40,000,000 cards compromised, that would be basically every card they handle assumed to have ben compromised, an imprtessive feat indeed. The person would have had to have a consistent and unnoticedconne3ction to the server, or walked out with a burned dvd or two of information.
    The other interesting mathimatical issue that came up was the child molester in Oregon, he was reported to have molested 30,000 kids over 35 years, 12 of which he spent in jail, hmmmm
    that would be over 4 seperate kids a day.
    I can't even find a way to molest 4 seperate drunk girls in a night with out at least one of them telling someone. I am calling bullshit on this one.
    • They said (and have since the first announcement AFAIK) that there were as many as 40 million cards at risk. The official MC line never said there were 40M cards compromised. Merely at risk. Some media outlets may have reported this wrong, but every report I, personally, heard since last week got it right.
    • Fair enough, but my worst-case math (everything stored in plaintext ascii, no compression) shows:

      40,000,000 cards
      16 acct digits per card
      4 date digits per card
      3 security digits per card
      ======================
      7.1526 gig of data

      If you use any compression or if the data were stored in a more efficient manner than ascii, the size drops dramatically.

      Even a full 7.1 gig can go down a DS3 in ~25 minutes. Even T1 takes less than 12 hours (read: start at 6pm finish at 6am).
  • "MasterCard said Saturday that 68,000 of its own account numbers were especially at risk because they were in a file found to have actually been "exported from the system."

     So in reality, they are only saying that they know of 68k that were downloaded. I believe it should be treated as if the other 39 million were compromised. I mean if someone cracks a system on your network do you only consider passwords used on that machine to be compromised? No, you change them all!

  • We end up paying in the end... (Score:3, Insightful)

    by Toadius ( 886709 ) on Monday June 20, 2005 @06:11PM (#12867308)
    Damn it, I'm sick of this weekly news of credit card security breaches. In this case the data wasn't even encrypted.

    "Zero liability for customers means that fraudulent charges come out of a bank or store's coffers in the form of higher merchant transaction fees. 'The retailers will pay for it and the issuing banks will get rich off it,' Ms. Litan said. 'It's just another revenue stream.'"

    Sorry, I call bullshit. Retailers pass the higher costs onto you and I.

    "'We should not have been doing that,' Mr. Perry said. 'That, however, has been remediated.' As for the sensitive data, he added, 'We no longer store it on files.'"

    Thats just fine Mr. Perry. Now may I have the credit card numbers, addresses, phone numbers, ss#'s, etc. of you, your family and the execs at Cardsystems Solutions? I *promise* to keep them safe and give them the same care you provided the other customers....

  • Why are they still in business? (Score:5, Insightful)

    by stinerman ( 812158 ) on Monday June 20, 2005 @06:11PM (#12867309)
    From TFA:

    Jessica Antle, a MasterCard spokeswoman, said that CardSystems had never demonstrated compliance with MasterCard's standards. "They were in violation of our rules," she said.

    Asked about compliance with Visa's standards, a Visa spokeswoman, Rosetta Jones, said, "This particular processor was not following Visa's security requirements when we found out there was a potential data compromise."

    Question:

    Why is CardSystems Solutions still a processor for Visa and MasterCard?

  • An interesting data analysis problem (Score:5, Interesting)

    by G4from128k ( 686170 ) on Monday June 20, 2005 @06:11PM (#12867312)
    The article alludes to fraudulent activity starting back in mid-April leading to an investigation of this particular card processor in mid-May. That suggests that the card companies do some rather interesting statistical analyses on fraud patterns to find commonalities. In this case, they were able to detect that an unusual number of cards with fraudulent transactions had, at some point, a transaction that shared a common card processor sometime in the past.

    Obviously, someone (I assume its Mastercard, Visa, etc.) is storing sufficient volume of historical transactions (including metadata such as the 3rd-party transaction processor) to analyze patterns such as this. With some 60 billion card transactions per year worldwide, this would make for a very large dataset and a very interesting analysis problem.

  • For Science! (Score:4, Funny)

    by EvilMagnus ( 32878 ) on Monday June 20, 2005 @06:16PM (#12867335)
    John M. Perry, CEO of the processor in question, claims the data was merely being kept for "research purposes."

    Well, that makes it all OK, then, doesn't it? So long as it was for Science.

  • Contractual damages? (Score:3, Insightful)

    by coyote-san ( 38515 ) on Monday June 20, 2005 @06:22PM (#12867378)
    What are the contractual damages for violating there agreement?

    I think $50 / incident is probably reasonable. That's enough to get the attention of the mom and pop store that might be facing damages of ten thousand dollars for improperly storing the CC numbers of a few hundred customers, but it's no so overwhelming that they would be forced out of business.

    A major processor that held 40M records (assuming that that was the number of improperly held records, and the lower number were just those that might have been exposed). They deserve a $2 billion contractual damage.

    Mastercard would never collect that much in damages, of course, but it would be a corporate death sentence to any company -- and its executives -- deciding to do illicit "research." One prominent case could go a long way towards restoring confidence.

  • Moral Hazzard? (Score:5, Interesting)

    by DaveInAustin ( 549058 ) on Monday June 20, 2005 @06:23PM (#12867383) Homepage
    This story [npr.org] on npr [npr.org] says that the credit card companies can actually wind up making money when a fraudulent charge is made. Does this create an incentive for them to keep things safe?

    • Re:Moral Hazzard? (Score:3, Insightful)

      by dkf ( 304284 )
      Whatever the merits of that story, the main credit card companies are going to be focussed on stamping this sort of thing out. The last thing they want is for consumers to lose confidence in their payment system, as that would make them go to some other mechanism that doesn't give them their cut. Their globally optimal strategy is probably to splat these bad-egg processors back into the stone age.
    • (I work for a credit card processor.)

      We need to be more specific. Some companies are credit card issuers -- they create the card numbers and own the bank accounts attached to those cards. Those companies end up collecting interchange and assessments (processing fees) on the sale, but then take the money back again.

      Some companies (like the one I work for, and like the one in the story) are credit card processors. We don't issue cards, we process payments against those cards and deposit funds in merchant

  • I hate these guys (Score:3, Informative)

    by ScooterBill ( 599835 ) * on Monday June 20, 2005 @06:25PM (#12867397)
    We used them as processors for about a year. We couldn't get rid of them fast enough. They hid all sorts of fees in our merchant charges and the "great deal" we got from them had so many exceptions that it was worthless. It left a real bas taste in my mouth. I sure hope they get the same treatment in reverse. Ha!

  • When will these companies be held responsible? (Score:5, Interesting)

    by Todd Knarr ( 15451 ) on Monday June 20, 2005 @06:28PM (#12867416) Homepage

    That's what I want to know: when will companies that mishandle data like this be held 100% responsible to the people whose data they mishandled for the losses, fraud, etc.? I'm of the opinion that only when mishandling data results in actual financial consequences to the mishandler will things change.

    • My understanding is that the credit card companies have their "zero liability" policy (consumer doesn't pay for fraudulent charges) in order to do just that. In one fell swoop, it keeps them from being sued by consumers (since they can't lose money from theft) and allows them to firmly place the burden on the processors for being responsible for the data. They dodge two bullets at once.
  • Last week, after the whole 40m CC flap, a helicopter transporting six executives of MBNA Financial Services-- the company implicated in the security breach-- crashed into the East River.

    http://www.pennlive.com/newsflash/pa/index.ssf?/b a se/national-46/1119097504217410.xml&storylist=paho mepage [pennlive.com]

    Things that make you go HMMMMM.
  • Like most of the other posters, I am ready for a solution to this problem. Fortunately, a pretty good technology solution was developed for this problem years ago - Secure Electronic Transactions (SET) [ectag.org]. However, there was minimal interest in the US at the time to adopt it (more interest in Europe).

    The technology is based on digital signatures and electronic wallets. It's quite sophisticated. Perhaps it's time to dust it off and give it another whirl.

  • From this story:
    http://news.com.com/Lost+credit+data+improperly+k e pt%2C+company+admits/2100-1029_3-5753557.html?tag= nefd.top [com.com]

    "The security breach was first reported Friday, when MasterCard International said a lapse at CardSystems had allowed the installation of a rogue computer program that could extract data from the system, potentially compromising 40 million accounts of various credit cards."

    They put this information on a laptop running Windows, connected to the internet, and it got Spyware... wo
    • forget about the laptop part...I don't know where I got the bit about the laptop but rereading shows nothing about that. The quote is still valid though. It was a "rogue computer program"..... I guess they don't know that everyone else calls these Spyware programs.

      Lob

  • Read here for how Visa/Mastercard control this crp (Score:4, Informative)

    by twigles ( 756194 ) on Monday June 20, 2005 @07:00PM (#12867628)
    Ok, Visa and Mastercard have a set of thresholds and guidelines for data security, retention and the like. How it works in a nutshell is once a business, be it your local cable provider or some card processing company or whatever, hits some number (not sure what that is) of transactions or money, they have to conform to a set of "best practices" defined by Visa/Mastercard (the two have agreed to the same set of requirements). Look here for more info [visa.com] or just google for "visa cisp".

    Essentially they are just that: best practices. I just did an audit prepping a company for Visa CISP certification and most things they require are pretty standard like password complexity, physical security, encryption used over public links, etc.. However the security all revolves around the credit card number so it's a little more focused than a normal security gig.

    Also, Visa/Master require that vendors store as little info as possible in as few places as possible, and that they encrypt it in storage. Specifically no one is EVER supposed to store the CVV/CVC code or any portion of the magnetic stripe info. Also specific to this set of requirements, a subpoint of it being CC#-centric, is that even non-mission-critical systems have to have the same high level of security if they store CC info. So no one gives a shit if you are doing "research" or just processing sales, you HAVE to protect the numbers, ideally by encrypting that field in Oracle or something equivalent so when FedEx loses your backup tape it isn't a disaster.

    One last caveat is that the program is still ramping up. It started about 4 years ago but most companies are struggling to implement the reqs still, and Visa is very understanding since if they are too stringent and cut off the offending vendor they lose revenue.

  • Looks like I was hit (Score:4, Interesting)

    by Urgo ( 28400 ) on Monday June 20, 2005 @08:17PM (#12868099) Homepage
    I got two emails from my bank today (10:52am and 4:59pm EST).

    Dear Customer,

    An incident involving unauthorized access into a third party processor system has occurred. A company which processes transactions for physical retail merchants and Internet merchants was the victim of a computer hacker between September 2004 and May 2005. They have identified your check and/or credit card as one of the cards possibly exposed. Information compromised includes account numbers and expiration dates, as well as cardholder names and addresses.

    We understand that you will most likely be concerned when you read this. Rest assured that if you information has fallen into the wrong hands, you will not be liable for any unauthorized transactions using your Check Card or VISA Card*. However, it is very important that you monitor your account(s) closely and notify us immediately of any unauthorized transaction. If such a transaction does occur, you will need to complete a VISA dispute form, available through the maintenance area of our online banking system, in order to receive provisional credit for the amount of the transaction. We recommend, as a precaution, that you call Customer Support to block your card and we will re-issue a new one. Our Banking Specialists and Loan Representatives will make that decision with you on a case-by-case basis, as we do not want to hamper your use of the card.

    We also understand that you will have other questions, such as the identity of the processor. When we receive notifications of this variety from VISA, VISA does not and will not reveal the name of the merchant or processor unless the incident has already been made public by the merchant.

    Again, we do ask that you monitor your account carefully in the weeks ahead by making use of our telephone, wireless, and online banking systems. If you have any questions or concerns, please contact a Banking Specialist or Loan Representative for more information.

    Thank you for banking with us.

    *This limit on liability does not apply to PIN-based ATM or point-of-sale transactions.

Slashdot Top Deals

2.4 statute miles of surgical tubing at Yale U. = 1 I.V.League

Close