Credit card breaches reported at two companies with over half a million users possibly affected
Network Solutions, which hosts the websites, announced that it had found malicious code on servers supporting some of its customer's online stores. Between 12th March and 8th June 2009, details of approximately 573,928 cardholders appeared to have been captured by malware that could have been used to transfer confidential card information.
In a statement on its website, Network Solutions claimed that in the ordinary course of business it identified unauthorised code on servers supporting some of its ecommerce merchants' websites.
The company said: “We promptly removed this code, and all of our ecommerce servers are functioning properly. No servers supporting networksolutions.com were affected.
“At this point, we have no reports or other reasons to believe that any credit card account information has been misused and, under established practice, credit card issuing companies generally will not hold our merchants' customers liable for any fraudulent purchases made using their credit card account numbers that are reported in a timely way to the issuer.
“Our customers' ability to rely on the safety of our solutions is our highest priority. We are deeply sorry for any concern or inconvenience this may cause our merchants or their customers.”
It claimed that it is working with a credit reporting agency to contact its merchants' customers whose data may have been affected, and provide services that will help potentially affected US-based customers protect their information.
Graham Cluley, senior technology consultant at Sophos, said: “This obviously has the potential to be a public relations disaster for Network Solutions - not only for the people who have had their credit card information stolen, but also for the merchants (many of whom will be small businesses) who are bound under various state statutes to inform their US customers when the security of their personal information has been compromised.
“Network Solutions, however, is smart enough to know that it needs to work quickly in situations like this to make the best out of a bad situation. For instance, it makes some play out of the fact that it has engaged with social media sites and bloggers to spread information and advice about the crisis, and how affected individuals and businesses should respond.”
Another breach was also reported by the Japanese arm of global insurer Alico with the credit card data of approximately 110,000 customers affected. Of those affected, more than 1,000 customers have seen fraudulent charges on their credit cards, and the credit card companies alerted Alico to the alleged theft.
A spokesperson for Alico said that the company has yet to determine how the data could have been leaked.
Steve Moyle, founder and CTO at Secerno, said: “This breach brings to mind RBS WorldPay and Heartland, in which customers saw fraudulent charges on their credit card bills before the companies realised they had been breached.
“In this type of situation, Alico is left playing 'catch up' without the ability to stop additional damage to its customers, because their data has already been compromised. We hope that the company and all in the industry use this as a lesson as to the importance of knowing the location and status of their data at all times because it will always be an attractive target.”