A data breach affecting Twin America, the parent company of CitySights NY, potentially compromised an estimated 100,000 customers' personal details, including credit card numbers.
According to a security breach notification letter sent to the New Hampshire attorney general, as required by that state's laws, attackers successfully exploited a Twin America Web server by using a SQL injection attack.
The letter, written by Twin America's lawyer, Theodore Augustinos, said that Twin America first suspected its systems had been breached in late October, "when a Web programmer discovered [an] unauthorized script that appears to have been uploaded to the company's Web server." The script appeared to have been actively siphoning off sensitive information from a database stored on the server for about four weeks before being discovered.
According to the letter, dated Dec. 9, "the database contained cardholder name, address, e-mail address, credit card number, expiration date, and CVV2" information. Given that the tour operator had to issue a data breach notification, it appears that the information wasn't encrypted, as that typically exempts an organization from having to issue a data breach notification.
But storing CVV2 -- card verification -- data would put the company in violation of the Payment Card Industry Data Security Standard (PCI DSS), which expressly forbids merchants from storing CVV2 data, even in encrypted form, once a transaction has been authorized by a credit or debit card provider.
Interestingly, 1,850 Massachusetts residents were also affected by the breach, which could make it the first test of that state's recently enacted data breach laws, which are amongst the toughest in the nation. According to antivirus vendor Kaspersky Labs' Threatpost, the state's law, known as 201 CMR 17, "requires organizations that store personal information on Massachusetts' residents to encrypt personal information at rest -- in databases, servers, laptops, desktops, mobile devices," as well as "data transmitted over wired or wireless networks." Violators may be hit with fines or lawsuits filed by the state's attorney general.
According to the Identity Theft Resource Center (ITRC), so far in 2010 there have been 654 publicly reported breaches in the United States which collectively exposed more than 16 million records. That puts the year on track to record many fewer breaches than in 2009, when the ITRC saw 222 million records potentially comprised. On the other hand, just two large breaches accounted for 200 million of those records.
But counting breaches is an inexact science. For starters, numerous data breaches go unreported, despite state laws to the contrary. The ITRC also said that in 2009, more than half of all companies that publicly disclosed they'd been breached didn't specify the number of people who might have been affected.
