Seibertron.com Energon Pub Forums

[Banjo-Tron]

1) Billing or Collection Issues - The company has unethical collection practices

It depends what is meant by 'collection' in this context, but you could argue that not making best effort to encrypt customer data falls under ethics

2)
Service Issues - An improper or inferior service

'Improper' because their service broke, 'inferior' because it is such an antiquated UI and Backend

3)
Service Issues - An unauthorized service

Not sure if this could be interpreted to include unauthorised transactions

Of these 3, I would go for number 2, as it seems to fit the best.

[El Duque]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

[ubertenorman]

This is the kind of correspondance that should have happened a month ago.

[triKlops]

agreed

[Emperor Galvatron]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

So if they have all of our order information, they also have our names, ages, addresses, etc that was stored on their site.

Well, that's just peachy.

Hey, cancel your credit cards, never mind the identity theft potential. Disregard the man behind the curtain.

[autobot_goldbug]

There was also this bizarre occurrence...
http://www.tfw2005.com/boards/transform ... ost7449720

[Stormrider]

I am not happy for several reasons. How could their security fail and no one noticed it for several months? I still think they are still down playing the threat. The thieves may have had access to our addresses and DOB. They really should be telling people watch your credit reports like a hawk. Fraudulent charges on your credit card are easy to spot. Identity theft and new credit cards that get opened fraudulently in your name using your stolen DOB is not so easy to spot.

[datguy86]

You can add me to the growing list of people who've been hit. Card's canceled, all items are not my fault - but all signs point to FunPub.

[Rated X]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

So if they have all of our order information, they also have our names, ages, addresses, etc that was stored on their site.

Well, that's just peachy.

Hey, cancel your credit cards, never mind the identity theft potential. Disregard the man behind the curtain.

I would think someone would need your social security number to do any real damage in identity theft. That’s how illegal immigrants get legit jobs.

[Stormrider]

You are 100% right. A social security # is needed for most identity theft. But acquiring the SS# is not as difficult as most think. The numbers that make it up represent the year and region that you were born in. The remaining numbers can often be deduced.

It's not too difficult to figure out the place you were born, if I know your DOB and full name.

When my identity was stolen. Initially, the thieves opened several small accounts using my name and DOB. They did not use my SS#. (My theory is that they didn't have it at that time). Three months later, they figured it out and the flood gates were opened.


Ryan, or others that deal with website design - isn't mandatory for companies nowadays to properly store credit card numbers? Have some laws been broken on FunPub's part?