Official message from Hasbro to Transformers and G.I. Joe fan communities regarding Fun Publications

I applaud Hasbro for making a public statement on this matter, although the line below is pretty appalling to me.

Hasbro wrote:-- They believe that the number of customers affected is low relative to the volume of sales transactions made.

If you're talking about the last year, then maybe but since February...YIKES.

In short, Hasbro is sticking its head in the sand.

Delicon wrote:I applaud Hasbro for making a public statement on this matter, although the line below is pretty appalling to me.

Hasbro wrote:-- They believe that the number of customers affected is low relative to the volume of sales transactions made.

If you're talking about the last year, then maybe but since February...YIKES.

I hope Hasbro understands that that can't be true. It appears all of our account and payment information was stored in a local database. The entire database would have been hacked. Either the hackers would have grabbed all of the info or none of it. It was just sitting out in the open, as far as hackers would be concerned. Anyone who had used a credit card with them in the past few years was affected.

I demand free toys!

RiddlerJ wrote:I demand free toys!

I demand a G2 ramjet. Even though no charges were made on my card, and I canceled said card (awaiting a new one...) but damn I want Ramjet

Just another message full of whitenoise, give us a free botcon exclusive and it might just take the sting away.....hmmm or would that be another kick in the teeth.

I guess I don't know what I was expecting, but more corporate BS when I had two credit cards tank because of this was not it.

It is too bad that the whole story is not being shared/told. Still it is bad to hear that ex members were getting hit also.

Not only does the "not too many were hit" line sting, the Fun Pub logo next to the Hasbro logo amplifies the fact that Fun Pub's logo is terrible. It is an uninspired imitation of the Hasbro logo done in, perhaps, Microsoft Word. Terrible. Unprofessional. Appropriate.

As much as I love bashing Hasbro, Im gonna side with them on this issue. Even Alcatraz security was breached at one point. Pointing fingers is not important anymore. What is more important is making sure it never happens again. And also to reimburse those who were affected. Maybe a free years membership would be appropiate. It's not like every time somebody hacks people's info from a gas pump or ATM machine do you get an official company statement. Life goes on...

Rated X wrote:As much as I love bashing Hasbro, Im gonna side with them on this issue. Even Alcatraz security was breached at one point. Pointing fingers is not important anymore. What is more important is making sure it never happens again. And also to reimburse those who were affected. Maybe a free years membership would be appropiate. It's not like every time somebody hacks a gas pump or ATM do you get an official company statement. Life goes on...

So SONY was not issuing all kinds of warnings and public statements when they got jacked? I think they were.

One years membership $40, credit card fraud charges $4000. Hmmm... Not that most cc companies won't remove the charges if you can prove that it is fraud. If they won't you should get a new card.

Moving on for some after this is easy. For others whose finances are a but more crunched...not so much.

I think the Club should give their customers the same thing TFsource did after their multiple fiascoes...

Hasbro wrote:-- They believe that the number of customers affected is low relative to the volume of sales transactions made.

Seriously? Pull your heads out of the sand! Plenty of people got hit. It's unbelievable that the amount of customers affected were "low". Poppycock!

tigertracks 24 wrote:

Rated X wrote:As much as I love bashing Hasbro, Im gonna side with them on this issue. Even Alcatraz security was breached at one point. Pointing fingers is not important anymore. What is more important is making sure it never happens again. And also to reimburse those who were affected. Maybe a free years membership would be appropiate. It's not like every time somebody hacks a gas pump or ATM do you get an official company statement. Life goes on...

So SONY was not issuing all kinds of warnings and public statements when they got jacked? I think they were.

One years membership $40, credit card fraud charges $4000. Hmmm... Not that most cc companies won't remove the charges if you can prove that it is fraud. If they won't you should get a new card.

Moving on for some after this is easy. For others whose finances are a but more crunched...not so much.

It's not about whether or not other companies have had similar issues. One of the major problems with all of this is that simple steps were not taken to protect our information. It was due to their negligence that this happened. Our passwords weren't even protected ... that's some pretty basic stuff right there. If care couldn't be had to protect our passwords, how could we expect that our credit card information was protected. The fandom has complained about the late 1990s style website for quite some time ... this was the consequence of their website not being updated properly circa 2006 to use modern standards and modern requirements that the credit card companies have in order to be PCI compliant.

Big companies get hacked because they are big targets. I'd imagine the hackers who gained entrance to the systems that huge companies like iTunes and Sony use are hackers on the cutting edge of figuring out where security holes are. Big companies such as those two most likely do not have our passwords just sitting around unencrypted and they are most likely PCI Compliant. Comparing what happened due to the negligence of Fun Pub is apples and oranges to what has happened to the larger companies.

Even your passwords on Seibertron.com are encrypted ... there's no way for me to decrypt the passwords here.

Kibble wrote:I think the Club should give their customers the same thing TFsource did after their multiple fiascoes...

Have any of you considered that TFsource only had one situation. From what I understood, the second situation was never actually tied to TFsource. Perhaps the second issue which people assumed came from TFsource actually came from another source that we all regularly use.

tigertracks 24 wrote:

Rated X wrote:As much as I love bashing Hasbro, Im gonna side with them on this issue. Even Alcatraz security was breached at one point. Pointing fingers is not important anymore. What is more important is making sure it never happens again. And also to reimburse those who were affected. Maybe a free years membership would be appropiate. It's not like every time somebody hacks a gas pump or ATM do you get an official company statement. Life goes on...

So SONY was not issuing all kinds of warnings and public statements when they got jacked? I think they were.

One years membership $40, credit card fraud charges $4000. Hmmm... Not that most cc companies won't remove the charges if you can prove that it is fraud. If they won't you should get a new card.

Moving on for some after this is easy. For others whose finances are a but more crunched...not so much.

All Im saying is credit card fraud happens every day. You discover it, report the charges to your company and get them removed, and get a new card. That's the credit card companies job. They take the hit. They make billions in interest on people who cant pay their bills in full. What else can Hasbro and Funpub do except issue a statement and request information to help track down the theif ? But It seems Transformer fans are expecting a free handout. Thats why I suggested a years membership free. $40 bucks is more than enough reimbursment for making a few annoying phone calls and cancelling a card.

If you write your own checks and review your monthly balance before you pay, any fradulaunt charge should be detected and removed before any hassle. If you pay $4000 in charges and then review your statement after you paid, youre fault. That's why I dont authorize my bank to make any automatic payments. It's not the banks job to catch fake charges, it's mine.

I've twice ordered merchandise from Fun Publications, yet my credit card info was stolen & I had to cancel my account.

This happened despite me not checking the option of storing my credit card info on the website.

Seibertron wrote:Have any of you considered that TFsource only had one situation. From what I understood, the second situation was never actually tied to TFsource. Perhaps the second issue which people assumed came from TFsource actually came from another source that we all regularly use.

If you believe that you should be giving TFCC the same benefit of doubt because the supporting evidence is about equal. Every one of my local crew that used a card at TFsource got hit. I never used a card w/ TFsource and I didn't get hit, but I did use my card w/ PSN which some were looking to blame it on. Others that ONLY used their card w/ TFsource and nothing else were hit. At least TFCC is owning up to it, though...

Kibble wrote:

Seibertron wrote:Have any of you considered that TFsource only had one situation. From what I understood, the second situation was never actually tied to TFsource. Perhaps the second issue which people assumed came from TFsource actually came from another source that we all regularly use.

If you believe that you should be giving TFCC the same benefit of doubt because the supporting evidence is about equal. Every one of my local crew that used a card at TFsource got hit. I never used a card w/ TFsource and I didn't get hit, but I did use my card w/ PSN which some were looking to blame it on. Others that ONLY used their card w/ TFsource and nothing else were hit. At least TFCC is owning up to it, though...

Are you referring to the incident that happened around January 2010 or April 2011?

April 2011...same time frame as PSN.

Kibble wrote:April 2011...same time frame as PSN.

And you had never used your cards with Fun Pub, BotCon or the Transformers Collectors Club prior to that date? Did you use the same card with PSN?

Seibertron wrote:

Kibble wrote:April 2011...same time frame as PSN.

And you had never used your cards with Fun Pub, BotCon or the Transformers Collectors Club prior to that date?

I'm not following...I have two cards that were recently hit, both of which I attempted to use with TFCC on 1/30. They were clearly the culprit. My point was if you somehow believe TFsource wasn't compromised back in April, you should equally believe maybe TFCC isn't to blame here, too. They both have comparable evidence against them...beyond a reasonable doubt.

Kibble wrote:

Seibertron wrote:

Kibble wrote:April 2011...same time frame as PSN.

And you had never used your cards with Fun Pub, BotCon or the Transformers Collectors Club prior to that date?

I'm not following...I have two cards that were recently hit, both of which I attempted to use with TFCC on 1/30. They were clearly the culprit. My point was if you somehow believe TFsource wasn't compromised back in April, you should equally believe maybe TFCC isn't to blame here, too. They have comparable evidence against them...beyond a reasonable doubt.

I firmly believe they are too blame in this situation. TFsource acknowledged their fault in regards to the January 2010 incident. The spring 2011 situation was never officially confirmed as coming from TFsource. It wasn't clear either they were the source of the problem (see the discussion here), which is why we never linked it back to TFsource last year like we did in 2010 and like we did with Fun Pub in 2012. There was much debate about the source, and once PSN came into play it muddied the situation even further. The fan anger died off pretty quick compared to what happened in 2010, which meant I stopped looking further into the situation at that time.

There seemed to be a lot of confusion with that incident about the actual source of that problem and whether it was from PSN, TFsource, etc. I've since seen some people suggest that the source of last year's situation may have come from Fun Pub instead of TFsource. I'm just inquiring about your particular situation to see what your particular experience was.

Seibertron wrote:There seemed to be a lot of confusion with that incident about the actual source of that problem and whether it was from PSN, TFsource, etc. I've since seen some people suggest that the source of last year's situation may have come from Fun Pub instead of TFsource. I'm just inquiring about your particular situation to see what your particular experience was.

I have never used a card at TFsource, always paypal. The card I used for PSN never had an issue until recently when I used it as a backup source with TFCC for the first time because my primary card failed. So I never had an issue from PSN...the compromise was clearly due to TFCC. Of my local crew, all that used a card with TFsource were hit, a number of those don't have PS3s so no PSN. I know a handful of them also aren't members of TFCC so that's not in play. There were also reports of new cards only ever used at TFsource that were compromised. And I guess that's the problem...TFsource doesn't even acknowledge that it was them so they obviously didn't do anything to shore up the issue. I guess I don't understand the outrage toward TFCC who at least appear to be doing something about it. But then again, give it a few months and maybe everyone will forget about the Club's issues too.

Although I seriusly doubt it....I hope this means Hasbro is paying more attention to this..well let's just say it...complete F*** UP!!! by Fun Pub. I also hope for the sake of the person that runs Fun Pub that if this is proven to have happened because of his negligence in updating his website with the proper security protocols, that legal action can..and more than likely will be taken against him. All I can do is shake my head at this situation....oh and by the way....telling people to "cancel your credit cards and/or debit cards" after your website has been severley hacked is not "handling" the situation....it telling us S*** we already know.....

Kibble wrote:I guess I don't understand the outrage toward TFCC who at least appear to be doing something about it. But then again, give it a few months and maybe everyone will forget about the Club's issues too.

Most of the "outrage" is all due to how the situation was handled and how "we've" been handled by Fun Pub. While I'm sure those who got hit with fraud charges were upset, it was how the situation was handled from that point forward that really upset people.

In addition, all of our credit card info (past and present) as well as our personal account information, usernames, unprotected passwords, email addresses, street addresses, dates of birth (I believe that's one of the fields they collect), etc were all taken as well. IMO, this situation was far worse than what happened with TFsource, since all of our personal information went plus the "Transformers Collectors' Club" is advertised on every Hasbro Transformers package, which brings Hasbro into the mix instead of it just being an online retailer.

Can't wait for the identity theft reports to start coming in (that's sarcasm)! It's only a matter of time now. That will be far worse than fraudulent charges on credit cards.

Yep, no real surprises here with this article. I was expecting Hasbro to pipe up any day now to give notice to whats been going on. But it was handled exactly the way I figured they would. No real admissions or surprises and playing down the damages in an attempt to do damage control. Companies these days, especially the size of HASBRO have too many attorneys and spin team people advising them on public statments. Of course they and FunPub are not going to admit to negligence or wrongdoing, because any admission opens them up to financial loss with lawsuits etc.

The damage is done as far as I'm concerned. I was fortunate enough to get wind of all this before i joined the TFCC group so I dodged the bullet. I'll track down the G1 Runabout and Runamuck on the secondary market, and I won't be joining the club anytime soon (probobly ever at this point). I have a feeling that heads will eventually roll at FunPub because Hasbro will apply liscence pressure and force changes, maybe reassign B. Savage etc....I don't really know the players in the company enough to have an opinion on how it should be dealt with.

BUT, to those of you that are requesting free figures and year long memberships renewals for nothing...whether your joking around or not, I fell confident in saying, "That ain't gonna happen!"
I'm not saying it's right, but I accept the reality of the situation for what it is....a big ol' cluster F__k. It's not in the nature of big companies to do stuff like that these days (give out freebies), it's unfortunate. The almighty dollar and good ol' fashioned greed are how most big business is run, with a culture of covering your ass legaly, thrown in there for good measure. So keep dreaming if you think they're gonna give away entire membership packages for nothing. I hope we can move on from this after Botcon, but something definatly needs to be said by us at the convention to impress upon the powers that be that this doesn't need to happen again, EVER.

G1 Legacy wrote:BUT, to those of you that are requesting free figures and year long memberships renewals for nothing...whether your joking around or not, I fell confident in saying, "That ain't gonna happen!"

I'm not saying it's right, but I accept the reality of the situation for what it is....a big ol' cluster F__k. It's not in the nature of big companies to do stuff like that these days (give out freebies), it's unfortunate. The almighty dollar and good ol' fashioned greed are how most big business is run, with a culture of covering your ass legaly, thrown in there for good measure. So keep dreaming if you think they're gonna give away entire membership packages for nothing. I hope we can move on from this after Botcon, but something definatly needs to be said by us at the convention to impress upon the powers that be that this doesn't need to happen again, EVER.

I agree. No sense wasting time asking for something you won't receive. Only thing we should be asking for at this point is for big changes to happen wherever necessary so that this situation will be avoided in the future.

I also strongly agree that this situation should be brought up and discussed at both the Hasbro panel and at the Collectors' Club panel. The response "this isn't the place for this discussion" is not an appropriate response given the gravity of this situation. It is most definitely the place for this discussion. They should set aside five or ten minutes at both panels to discuss it. If they don't, I could see some fans getting a little unruly if this issue isn't brought up in some capacity. It can't just be pushed under a rug at this point.

G1 Legacy wrote:BUT, to those of you that are requesting free figures and year long memberships renewals for nothing...whether your joking around or not, I fell confident in saying, "That ain't gonna happen!"

Couldn't have said it better myself. None of uswill see anything from these people....cause that would be an admission that they ACTUALLY did something wrong...

I had my credit card stolen and a couple charges placed. It's been taken care of, new credit card, and refunded charges, but I wanted to notify them of it like they asked. However, they didn't seem to provide any way to contact them other than by phone. Does anyone have the contact info they referenced but didn't give?

Seibertron wrote:In addition, all of our credit card info (past and present) as well as our personal account information, usernames, unprotected passwords, email addresses, street addresses, dates of birth (I believe that's one of the fields they collect), etc were all taken as well. IMO, this situation was far worse than what happened with TFsource, since all of our personal information went plus the "Transformers Collectors' Club" is advertised on every Hasbro Transformers package, which brings Hasbro into the mix instead of it just being an online retailer.

That's debatable...like I said, at least TFCC acknowledges it and appears to be doing something about finding out what happened and how to prevent it from happening again rather than pointing the finger at PSN and saying musta been them. I suspect if TFcurse is in denial about there being any issue on their end, it's probably not the last we'll see of that scenario. Hope people are at least using paypal...and not using the same login credentials. I'm pretty sympathetic to these things as it's a shitty situation all around and these guys are just as much victims as we are, but I think it's even shittier to pretend like nothing happened and the only measure you take to prevent it from happening again is just hope the bad guys don't come back around again.

Why the heck should I waste my time just to have my number added to the pile? I handled the fraud myself. What, do they want proof that it happened so they can give me a coupon to spend at their horrid club store? Yeah y'know what would really help me right now? If they'd get my order straightened out and send me my damned Over-Run which I ordered without a t-shirt! Then I can just put this all behind me and pretend these morons never existed.

Seibertron wrote:I also strongly agree that this situation should be brought up and discussed at both the Hasbro panel and at the Collectors' Club panel. The response "this isn't the place for this discussion" is not an appropriate response given the gravity of this situation. It is most definitely the place for this discussion. They should set aside five or ten minutes at both panels to discuss it. If they don't, I could see some fans getting a little unruly if this issue isn't brought up in some capacity. It can't just be pushed under a rug at this point.

Well, for what it's worth I'd like to help if I can. Even if it's just as an extra body for an angry mob lol. I was going to try and touch base with some of you, the Seibertron Hierarchy, as the convention date gets closer, I just havn't wanted to pester anybody quite yet. I'm not staying in the hotel, I'll be off site but I'd like to meet up wherever you all are having "happy hour" before the weekend festivities commence in case you discuss a game plan on how to approach this subject with Hasbro/FunPub. I agree it needs to be done tactfully yet ascertivley. It shoud make for an interesting s__t show wouldn't ya say. A Botcon to remember for sure

Lets do this!

G1 Legacy wrote:Seibertron wrote:

I also strongly agree that this situation should be brought up and discussed at both the Hasbro panel and at the Collectors' Club panel. The response "this isn't the place for this discussion" is not an appropriate response given the gravity of this situation. It is most definitely the place for this discussion. They should set aside five or ten minutes at both panels to discuss it. If they don't, I could see some fans getting a little unruly if this issue isn't brought up in some capacity. It can't just be pushed under a rug at this point.

Well, for what it's worth I'd like to help if I can. Even if it's just as an extra body for an angry mob lol. I was going to try and touch base with some of you, the Seibertron Hierarchy, as the convention date gets closer, I just havn't wanted to pester anybody quite yet. I'm not staying in the hotel, I'll be off site but I'd like to meet up wherever you all are having "happy hour" before the weekend festivities commence in case you discuss a game plan on how to approach this subject with Hasbro/FunPub. I agree it needs to be done tactfully yet ascertivley. It shoud make for an interesting s__t show wouldn't ya say. A Botcon to remember for sure

Lets do this!

Forget tactful and assertive. When we get closer to bot-con I'll show you how to make shivs out of the end of your tooth brushes and plastique from Toothpaste, moth balls, and ammonia.

chuckdawg1999 wrote:

G1 Legacy wrote:Seibertron wrote:

I also strongly agree that this situation should be brought up and discussed at both the Hasbro panel and at the Collectors' Club panel. The response "this isn't the place for this discussion" is not an appropriate response given the gravity of this situation. It is most definitely the place for this discussion. They should set aside five or ten minutes at both panels to discuss it. If they don't, I could see some fans getting a little unruly if this issue isn't brought up in some capacity. It can't just be pushed under a rug at this point.

Well, for what it's worth I'd like to help if I can. Even if it's just as an extra body for an angry mob lol. I was going to try and touch base with some of you, the Seibertron Hierarchy, as the convention date gets closer, I just havn't wanted to pester anybody quite yet. I'm not staying in the hotel, I'll be off site but I'd like to meet up wherever you all are having "happy hour" before the weekend festivities commence in case you discuss a game plan on how to approach this subject with Hasbro/FunPub. I agree it needs to be done tactfully yet ascertivley. It shoud make for an interesting s__t show wouldn't ya say. A Botcon to remember for sure

Lets do this!

Forget tactful and assertive. When we get closer to bot-con I'll show you how to make shivs out of the end of your tooth brushes and plastique from Toothpaste, moth balls, and ammonia.

*wipes tear*

You have made me proud, sir. Proud, I say!

So am I correct in saying there is a bounty on the owners of funpub??? LOL!

Well Hasbros statement didnt really tell us anything we didnt already know. But I guess I should be kind of glad that they are keeping an eye on things.

Kind of.

Vicalliose wrote: Yeah y'know what would really help me right now? If they'd get my order straightened out and send me my damned Over-Run which I ordered without a t-shirt! Then I can just put this all behind me and pretend these morons never existed.

Do you live outside of the States? I live in Australia and it always takes forever to get my figures off them, but I recieved my confirmation today that it has been sent. I also didnt purchase a shirt.Im just glad that its finally on the way. Hope you get your confirmation soon.

quickmixed wrote:Well Hasbros statement didnt really tell us anything we didnt already know. But I guess I should be kind of glad that they are keeping an eye on things.

Kind of.

Vicalliose wrote: Yeah y'know what would really help me right now? If they'd get my order straightened out and send me my damned Over-Run which I ordered without a t-shirt! Then I can just put this all behind me and pretend these morons never existed.

Do you live outside of the States? I live in Australia and it always takes forever to get my figures off them, but I recieved my confirmation today that it has been sent. I also didnt purchase a shirt.Im just glad that its finally on the way. Hope you get your confirmation soon.

I have not received mine, or notification of shipping, and I ordered the night after the first debacle of server shut down/overload.

Now the charges have been moved to my new un-canceled card for both my club exclusives, and my club renewal, so yeah, I'd like to see mine too.

And no, I did not order a shirt either...

AutobotMR2 wrote:So am I correct in saying there is a bounty on the owners of funpub??? LOL!

More like a Viva or Brawny.

tigertracks 24 wrote:

quickmixed wrote:Well Hasbros statement didnt really tell us anything we didnt already know. But I guess I should be kind of glad that they are keeping an eye on things.

Kind of.

Vicalliose wrote: Yeah y'know what would really help me right now? If they'd get my order straightened out and send me my damned Over-Run which I ordered without a t-shirt! Then I can just put this all behind me and pretend these morons never existed.

Do you live outside of the States? I live in Australia and it always takes forever to get my figures off them, but I recieved my confirmation today that it has been sent. I also didnt purchase a shirt.Im just glad that its finally on the way. Hope you get your confirmation soon.

I have not received mine, or notification of shipping, and I ordered the night after the first debacle of server shut down/overload.

Now the charges have been moved to my new un-canceled card for both my club exclusives, and my club renewal, so yeah, I'd like to see mine too.

And no, I did not order a shirt either...

I'm from the United States. There's about two states between me and them actually. Although I did check my e-mail a little while ago and it turns out they've finally sent it.

So, who wants to trade me a G2 Ramjet for it? Anyone?
In all seriousness, it depends on whether or not I can get my hands on the freebie, or just how much I actually like Over-Run in hand.

Well, I thought I was lucky enough to have escaped any issues with this, but woke up to fraudulent charges on my card today. PNC took care of everything, new card on the way.

anyone who attends botcon should boo Brain Savage when he makes his general announcements at the start of the con.

with all the cash he takes in, I am pretty sure he could have sprung for a site that properly protects his customers.

Sid Burn wrote:anyone who attends botcon should boo Brain Savage when he makes his general announcements at the start of the con.

with all the cash he takes in, I am pretty sure he could have sprung for a site that properly protects his customers.

That's not what people should do. Two wrongs don't make a right. While I am advocating that they should discuss the situation with us in person and not sweep things under the rug, people should not be acting like asses. They should be polite and courteous.

Seibertron wrote:

Sid Burn wrote:anyone who attends botcon should boo Brain Savage when he makes his general announcements at the start of the con.

with all the cash he takes in, I am pretty sure he could have sprung for a site that properly protects his customers.

That's not what people should do. Two wrongs don't make a right. While I am advocating that they should discuss the situation with us in person and not sweep things under the wrong, people should not be acting like asses. They should be polite and courteous.

I agree. So far Fun Pub has been giving us updates. Let them finish their investigation before raising pitch forks. But at the same time remain persistant with wanting answers.

Seibertron wrote:In addition, all of our credit card info (past and present) as well as our personal account information, usernames, unprotected passwords, email addresses, street addresses, dates of birth (I believe that's one of the fields they collect), etc were all taken as well. IMO, this situation was far worse than what happened with TFsource, since all of our personal information went plus the "Transformers Collectors' Club" is advertised on every Hasbro Transformers package, which brings Hasbro into the mix instead of it just being an online retailer.

Can't wait for the identity theft reports to start coming in (that's sarcasm)! It's only a matter of time now. That will be far worse than fraudulent charges on credit cards.

I just ordered mine to double check.

I agree that civility and patience should be exercised, here. However, if someone poses the question and they refuse to answer and/or get nasty about it, I think you should start with the booing and cause a scene. Embarrass them, force them to speak about it.

If it were any one of us, we'd be roasted on the spit if we screwed up like this.

Well this is lovely ... the username (CeMa^TkH) for their "secure" database is currently exposed on their website. Hopefully they will change the username after this so that hackers don't have an edge on knowing the username for their SQL database.

Error can be publicly seen when you try to login, or if you directly go to https://www.transformersclub.com/members/index.cfm

TransformersClub.com wrote:The web site you are accessing has experienced an unexpected error.
Please contact the website administrator.

The following information is meant for the website developer for debugging purposes.
Error Occurred While Processing Request
Error Executing Database Query.

[Macromedia][SQLServer JDBC Driver][SQLServer]Login failed for user 'CeMa^TkH'.

Resources:
Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.
Check the ColdFusion documentation to verify that you are using the correct syntax.
Search the Knowledge Base to find a solution to your problem.
Browser **********
Remote Address ***********
Referrer https://t.co/QQBaXdu4
Date/Time 06-Mar-12 06:16 PM

Seibertron wrote:Well this is lovely ... the username (CeMa^TkH) for their "secure" database is currently exposed on their website. Hopefully they will change the username after this so that hackers don't have an edge on knowing the username for their SQL database.

Error can be publicly seen when you try to login, or if you directly go to https://www.transformersclub.com/members/index.cfm

TransformersClub.com wrote:The web site you are accessing has experienced an unexpected error.
Please contact the website administrator.

The following information is meant for the website developer for debugging purposes.
Error Occurred While Processing Request
Error Executing Database Query.

[Macromedia][SQLServer JDBC Driver][SQLServer]Login failed for user 'CeMa^TkH'.

Resources:
Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.
Check the ColdFusion documentation to verify that you are using the correct syntax.
Search the Knowledge Base to find a solution to your problem.
Browser **********
Remote Address ***********
Referrer https://t.co/QQBaXdu4
Date/Time 06-Mar-12 06:16 PM

Sho' 'nuff.

Autobot032 wrote:I agree that civility and patience should be exercised, here. However, if someone poses the question and they refuse to answer and/or get nasty about it, I think you should start with the booing and cause a scene. Embarrass them, force them to speak about it.

If it were any one of us, we'd be roasted on the spit if we screwed up like this.

I would taste good with a nice smokey BBQ sauce. Low and slow, that's how you go.

Seibertron wrote:Well this is lovely ... the username (CeMa^TkH) for their "secure" database is currently exposed on their website. Hopefully they will change the username after this so that hackers don't have an edge on knowing the username for their SQL database.

Error can be publicly seen when you try to login, or if you directly go to https://www.transformersclub.com/members/index.cfm

TransformersClub.com wrote:The web site you are accessing has experienced an unexpected error.
Please contact the website administrator.

The following information is meant for the website developer for debugging purposes.
Error Occurred While Processing Request
Error Executing Database Query.

[Macromedia][SQLServer JDBC Driver][SQLServer]Login failed for user 'CeMa^TkH'.

Resources:
Enable Robust Exception Information to provide greater detail about the source of errors. In the Administrator, click Debugging & Logging > Debugging Settings, and select the Robust Exception Information option.
Check the ColdFusion documentation to verify that you are using the correct syntax.
Search the Knowledge Base to find a solution to your problem.
Browser **********
Remote Address ***********
Referrer https://t.co/QQBaXdu4
Date/Time 06-Mar-12 06:16 PM

Ryan,

Good catch on the additional security hole.

As web vets and I think we both know that FunPub outsources all of their web work. The first problem is that that team is clearly incompetent. I'm sure they've been back pedaling from day 1 trying to avoid a law suit but the reality is that a real team would have shut the site down at the first sign of trouble, patched the hole, been open about the cause and moved on. The second is that there does not seem to be an internal staffer capable of assessing the situation accurately, ie a properly trained/educated "Web Manager" that understands the need for the aforementioned security handling process.

Overall, this has been a wildly irresponsible period of activity on one of the worst fan e-com sites on the web. Twice over the last five years I've offered to redo the site, or hook them up with someone equally skilled, and have never received so much as a courtesy call back. And so here we are.

Truly in 2012 there is no excuse for this nonsense. It's taken too long to take the e-com portions of the site down, and Hasbro's contribution is little more than an artful dodge.

Given how many weeks this has gone on for, and how many people this has caused hassles for as well as credit report risks I don't actually believe that boos are the wrong move in a public forum ASSUMING they have done no more at that time to alleviate the user pain.

My 2 cents,

J

faustx wrote:Good catch on the additional security hole.

One of Seibertron.com's staff members brought the exposed error to my attention.