[ news_security_news ]
Idiot Watch: Porn Billing Blows Your Wad
John Stith
Staff Writer
2006-03-09
 Insider Reports RSS Feed
Online payment service iBill got hit with a money shot when the company managed to get hacked, having some 17 million names stolen. The names have already been circulating around the fraudster/spammer markets.
According to an article in Wired News, the stolen data included names, phone numbers, addresses, email addresses and IP addresses but that's not all. There were also users names and passwords, credit card types and purchase amounts. Apparently, the numbers themselves didn't make it out.
The database included transactions covering a period between 1998 and 2003. iBill is best known as billing agency for the online adult entertainment industry, which is vast. iBill while waning as of late, was one of the preeminent billing services in the online porn business.
The Secure Science security software company put this whole thing together with an assist from Sunbelt. They and both commented for Wired that this appears to be an inside job. According to their story, the files were generated by exporting and SQL database into a CSV format.
According to Wire, Sunbelt's Adam Thomas figured an employee or other insider walked out with the info and sold it on the black market.
While there more details to the story like neither iBill nor the FBI elected to notify customers of the breach, it's cases like this that help define the Idiot Watch. Companies are careless with their info, they don't make sure it's secure. And while this is no way to be 100% secure, allowing employees to walk out with the info isn't exactly a good idea either.
The problem is, with these records going back to 1998, 8 years ago, many may have forgotten about all this and won't know to look or it could be some other change in someone's behavior, etc. One can be assured though, none of the customers expected their information to show up on the internet in a plain brown wrapper.
Once again though, this shows information must be encrypted and companies, regardless of their situation, have a responsibility to protect that data or get rid of it. If they can't protect it, then they need to destroy it.
Tag: Idenitity Fraud
Get all the updates - click this link:  Add to | DiggThis| Yahoo My Web
About the Author:
John is a staff writer for SecurityProNews covering cyber security.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
