The Energon Pub

[robofreak]

I've been watching all of my funds like a hawk since Seibertron first alerted us to the issue, and found out this evening that I too am now another victim of the security breach. Keep close tabs on your funds everyone - the card in question (which has now been cancelled) was only used once when I went to my first/only BotCon in 2010

Wait, are you sure that card was only used for Botcon 2010? If that's the case, then the breach in security has been going longer than just this incident.

[TransBat]

My apologies, I just went back and reviewed my records, and the cancelled card in question was actually used twice at the TransFormers Collectors Club, once for BotCon 2010, and then late April 2011 for 4 deluxe Generations figures that were on sale at the time. I believe it was mentioned (or was it surmised?) that the hackers potentially had access to all previous records, hence the recommendations to cancel any card used with the Club in general.

[Seibertron]

Food for thought. When Hasbro pulled the license from 3H FunPub was already in the picture since they were doing JoeCon. There isn't anyone in the picture now to take over for FunPub and more importantly, who would want to?

CybertronCon is looking pretty good to me right about now. The people that are running that have been great to work with. They treat us with respect, present us with interview, photo, and press opportunities, get us into events as media, and seem to be doing what they should be doing with sites like Seibertron.com. You know ... actual public relations. Hopefully Hasbro is taking note.

[Burn]

When FunPub got the licence, their tech was most likely up to date.

They just neglected to move with the times.

[Seibertron]

When FunPub got the licence, their tech was most likely up to date.

They just neglected to move with the times.

You mean when they got the G.I. Joe license?

[Burn]

Yeah well that's probably more accurate considering for the first five years when I was a member they had to process my credit card manually every time because their check out system had trouble with some foreign cards.

[Oilspill]

My bank just detected fraudulent activity on my card last night, so be warned that if you thought the fraudsters hadn't got a hold of your card details, they probably have, they just may not have tried it yet.

I've regularly used this card all over the net for 5 years and never had a problem, then join TFCC a couple of months back and now it has been compromised.

I won't be rejoining unless they offer a more secure payment method like paypal.

[chuckdawg1999]

My check has cleared so I'm officially a member for 2012. Depending how things go this really might be my last year.

[autobot_goldbug]

I won't be rejoining unless they offer a more secure payment method like paypal.

That isn't more secure though. I had someone from Australia pay me for some Transformers. However my payment ended up in Malaysia instead.

I hope everyone that gets fraudulent charges does contact Fun Pub and Hasbro.
Also it wouldn't hurt to file a complaint with the BBB.org.

[Seibertron]

Do any of the following complaints though actually depict what has happened to us as consumers? Or rather ... which complaint best summarizes what has been your experience?

• ---- Please Select the Nature of your Complaint --
• Advertising Issues - An advertisement misrepresenting a product
• Advertising Issues - An advertisement misrepresenting a service
• Advertising Issues - A bait & switch advertisement
• Advertising Issues - An advertising price the seller will not honor
• Advertising Issues - An advertising term the seller will not honor
• Advertising Issues - An advertisement that failed to disclose all conditions required to take advantage of an offer
• Advertising Issues - An advertisement of a product that is not available
• Advertising Issues - An advertisement of a service that is not available
• Advertising Issues - An advertisement with unrealistic/unsubstantiated claims
• Billing or Collection Issues - The company has failed to correct billing errors
• Billing or Collection Issues - The company has processed an unauthorized credit card charges
• Billing or Collection Issues - The company has processed an unauthorized bank debit
• Billing or Collection Issues - The company has failed to provide itemized billing
• Billing or Collection Issues - The company has failed to provide an explanation of charges
• Billing or Collection Issues - The company has unethical collection practices
• Contract Issues - The authenticity or validity of a contract is in question
• Contract Issues - Work performed was outside the terms of the contract or agreement
• Contract Issues - A failure to honor a contract or agreement
• Contract Issues - Unauthorized changes to the contract or agreement
• Customer Service Issues - Customer service failed to provide assistance
• Customer Service Issues - The failure to respond to phone calls or written requests for assistance or support
• Customer Service Issues - The inappropriate behavior by customer service personnel
• Delivery Issues - The late delivery of products
• Delivery Issues - The late delivery of services
• Delivery Issues - The non-delivery of products
• Delivery Issues - The non-delivery of services
• Delivery Issues - A delivery regarding receipt of unordered products
• Delivery Issues - A delivery regarding receipt of unordered services
• Guarantee Or Warranty Issues - A failure to honor money-back guarantees
• Guarantee Or Warranty Issues - A failure to honor service under the terms of warranties
• Guarantee Or Warranty Issues - A dispute regarding the warranty coverage and/or terms
• Guarantee Or Warranty Issues - The failure to provide a promised written warranty or guarantee
• Product Issues - The product I purchased was defective
• Refund / Exchange Issues - The company failed to honor their policy regarding refund, exchange or credit
• Refund / Exchange Issues - The company failed to honor a verbal commitment to provide refunds, exchanges, or credit
• Repair Issues - An improper or inferior repair
• Repair Issues - An unreasonable or excessive delay in completing a repair
• Repair Issues - An unauthorized repair
• Repair Issues - The repairs resulted in additional damage
• Repair Issues - The failure to provide an invoice or estimate for repair upon request
• Repair Issues - The failure to honor a repair estimate or agreement
• Repair Issues - The failure to honor an advaced request to return the parts
• Sales Issues - A sales presentation that misrepresents the product
• Sales Issues - A sales presentation that misrepresents the service
• Sales Issues - A sales presentation with unethical sales practices
• Sales Issues - A sales presentation with high pressure sales
• Sales Issues - A sales presentation that had a verbal representation not consistent with the written agreement
• Sales Issues - A sales presentation not consistent with the advertisement
• Sales Issues - A sales presentation that failed to disclose key conditions of the offer
• Sales Issues - A sales presentation that did not disclose complete pricing information
• Service Issues - An improper or inferior service
• Service Issues - An unreasonable or excessive delay in completing service
• Service Issues - An unauthorized service
• Service Issues - The services provided resulted in additional damage
• Service Issues - The failure to provide an invoice or written estimate for service upon request
• Service Issues - The failure to honor a service estimate or agreement

[Banjo-Tron]

1) Billing or Collection Issues - The company has unethical collection practices

It depends what is meant by 'collection' in this context, but you could argue that not making best effort to encrypt customer data falls under ethics

2)
Service Issues - An improper or inferior service

'Improper' because their service broke, 'inferior' because it is such an antiquated UI and Backend

3)
Service Issues - An unauthorized service

Not sure if this could be interpreted to include unauthorised transactions

Of these 3, I would go for number 2, as it seems to fit the best.

[El Duque]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

[ubertenorman]

This is the kind of correspondance that should have happened a month ago.

[triKlops]

agreed

[Emperor Galvatron]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

So if they have all of our order information, they also have our names, ages, addresses, etc that was stored on their site.

Well, that's just peachy.

Hey, cancel your credit cards, never mind the identity theft potential. Disregard the man behind the curtain.

[autobot_goldbug]

There was also this bizarre occurrence...
http://www.tfw2005.com/boards/transform ... ost7449720

[Stormrider]

I am not happy for several reasons. How could their security fail and no one noticed it for several months? I still think they are still down playing the threat. The thieves may have had access to our addresses and DOB. They really should be telling people watch your credit reports like a hawk. Fraudulent charges on your credit card are easy to spot. Identity theft and new credit cards that get opened fraudulently in your name using your stolen DOB is not so easy to spot.

[datguy86]

You can add me to the growing list of people who've been hit. Card's canceled, all items are not my fault - but all signs point to FunPub.

[Rated X]

Fun Publications/TFCC have issued the following update regarding their recent security issues.

Here is the latest update on the credit card security investigation.

The firm we have hired to analyze our former ecommerce server and software has preliminarily determined that we did incur a SQL injection code attack sometime before Christmas. Our ISP did have a commercial product installed that was supposed to defeat these types of attacks, but apparently it failed.

This allowed the hackers access to our order information. While it is still unknown exactly what data they were able to harvest (investigation continues) we need to assume that they were able to extract all of our order information. The security firm thinks that this attack has allowed the hackers to come back periodically and harvest more information. However, once the old server was taken out of service (around February 21st) there was nothing left for them to access.

Once this information was stolen, (no matter if it was back before Christmas) there is no time frame as to when the thieves may sell or try to use the information to purport credit card theft.

What does this mean to me?

We are asking again that anyone who has used a credit card in our old online systems in the past year (NOT THE NEW STORE) to get your card replaced immediately. If you have done this already, there is no action required on your part.

We apologize for the inconvenience, we know this whole thing is a pain, but it is better to replace the cards than have to deal with any issues that may result from this theft of data. Even though the amount of fraud has greatly declined, we are still receiving a customer report every few days of someone else (who hasn’t replaced their cards) getting hit. We strongly encourage you to take this step immediately if you have not done so already. Again, this DOES NOT pertain to any cards that have been used in the new store.

What is the plan?

We are still working on all of the issues and are several weeks away from a final resolution. Our new store is currently offline while we complete the entries and audit the data from the renewals we received last week. Just to reiterate, this new store is a totally different piece of software, at a totally different hosting site. There are hundreds of other retailers using this same software as it is hosted by the software creators.

We hope to have the store online and registration system back online sometime next week. When the store comes back online, we will be adding products slowly so it will take some time to have everything back in the store.

Thank you for your patience and support during this trying issue.

Brian

So if they have all of our order information, they also have our names, ages, addresses, etc that was stored on their site.

Well, that's just peachy.

Hey, cancel your credit cards, never mind the identity theft potential. Disregard the man behind the curtain.

I would think someone would need your social security number to do any real damage in identity theft. That’s how illegal immigrants get legit jobs.

[Stormrider]

You are 100% right. A social security # is needed for most identity theft. But acquiring the SS# is not as difficult as most think. The numbers that make it up represent the year and region that you were born in. The remaining numbers can often be deduced.

It's not too difficult to figure out the place you were born, if I know your DOB and full name.

When my identity was stolen. Initially, the thieves opened several small accounts using my name and DOB. They did not use my SS#. (My theory is that they didn't have it at that time). Three months later, they figured it out and the flood gates were opened.


Ryan, or others that deal with website design - isn't mandatory for companies nowadays to properly store credit card numbers? Have some laws been broken on FunPub's part?

[Court Jester]

I thought it was going to be something about how they're going to make it up to their members.
Surprised to read them attempting to garner sympathy... again. The fans should come first.

We know their security failed; even they do. What do they expect from this press release, a pat on the shoulder? No, a trust has been broken. How about doing something small like calling up their artists and requesting an emergency 2-page comic based on the Run Bros - and sending the comic to its members via PDF? You know, something...

It's about the effort put into things (based on the hobby) that show you care more about your consumer base than to send out pointless emails that attempt to quell legal action. Report on the issue when the issue is resolved.

Until then, make me feel the membership is more than just a $60 toy and its $40 "freebie" companion - cuz right now, that's the reality.

[GetRightRobot]

All well and good guys. Goodluck to you in the future. Personally, I will be shopping from scalpers. Less risk, more cost....and...I can live with that.

[Seibertron]

I am not happy for several reasons. How could their security fail and no one noticed it for several months? I still think they are still down playing the threat. The thieves may have had access to our addresses and DOB. They really should be telling people watch your credit reports like a hawk. Fraudulent charges on your credit card are easy to spot. Identity theft and new credit cards that get opened fraudulently in your name using your stolen DOB is not so easy to spot.

Just offering my opinion from someone who's got a lot of experience with this ...

Imagine SQL injections are similar to a computer virus of some sort ... you usually don't know if your computer has a virus, you usually don't know that someone is taking advantages of SQL injections until after something bad happens. In one scenario, someone finds a weakness in the site's code by manipulating the URL where variables are being passed (such as a transaction ID, a user ID, a store order ID, etc.). They are able to insert a malicious command into the code because the programmer didn't verify that the variable was an integer or didn't include various characters that shouldn't be passed to the query. I know how to prevent it in my code, but I might not be able to best explain in layman's terms.

Wikipedia has a great explanation / summary ...

(I've always said "see-kwell" for SQL, but it is often pronounced by it's letters S-Q-L)

An SQL injection is often used to attack the security of a website by inputting SQL statements in a web form to get a poorly designed website to perform operations on the database (often to dump the database content to the attacker) other than the usual operations as intended by the designer. SQL injection is a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

Wikipedia's article can be found at http://en.wikipedia.org/wiki/Sql_injection

[Seibertron]

Ryan, or others that deal with website design - isn't mandatory for companies nowadays to properly store credit card numbers?

Not at all. It's best practice for companies not to store credit card information such as the card number and CID, but there's nothing to mandate that. Just best practices. Kind of like it's best practice to look both ways before crossing the street but there isn't a law per se about it, not at least to my knowledge.

[zodconvoy]

Ryan, or others that deal with website design - isn't mandatory for companies nowadays to properly store credit card numbers?

Not at all. It's best practice for companies not to store credit card information such as the card number and CID, but there's nothing to mandate that. Just best practices. Kind of like it's best practice to look both ways before crossing the street but there isn't a law per se about it, not at least to my knowledge.

Looking both ways is not a law. The best way to tell is that every person hit by a car isn't counter sued for damage to the vehicle due to pedestrian negligence. Someone getting hit by a car also would not be covered by most insurance (auto or medical) until a legal determination of guilt has been given.

My grandfather and uncle were/are lawyers and it was explained to me this way: "if people aren't sued, ticketed, or arrested for it everyday, it's not against the law."

And my mom worked for Blue Cross (higher than midway up the corporate ladder) so common table talk was how insurance companies screw you and I know from experience that when you get hit by a car, you're covered!