Disney subcontractor caught selling customer data
82841
Here's a goofy story that's not the least bit funny: A subcontractor for a company handling credit-card info for the Disney Movie Club has been arrested for trying to sell customers' personal data to undercover law enforcement agents.
61152
Allied Capital, a Washington financial services firm, said yesterday that someone it hired had obtained the  phone records of David Einhorn, a hedge-fund manager who has accused the company of fraud, and Einhorn's company, Greenlight Capital.
716178
Company notifys employees that a stolen laptop contained AT&T Corp.'s benefits plans data.
696381
The apparel retailer is using secrecy, but is there anything worth hiding?
334778
U.S. market regulators charged Walt  Disney Co. DIS.N on Monday with failing to disclose a web of  relationships between the entertainment giant and some of its  directors and their family members.
479464
(InfoWorld) - When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems. Just as the now famous attack on discount clothing chain TJX Stores revolved around the interception of data transmitted wirelessly from the company's registers to its databases, almost every call that Sartin receives from a retailer can be traced back to some issue related to point-of-sale information collection, he said. The data theft gumshoe -- whose official title is managing principal in the Investigative Response unit at managed security services provider Cybertrust, which was purchased by Verizon Business in May 2007 -- contends that if companies did a better job of defending their point-of-sale tools, most could dramatically lower their risk of a breach. "As a rule, companies are doing a better job of protecting against external IT systems intrusions, but if you look into most of these consumer breaches at retailers the point-of-sale technology is typically the common denominator," Sartin said. "Many retailers list the types of systems they use on their Web sites, so the smart criminals look for companies using systems they already know how to beat and simply try to find a way in." If retailers could merely stop collecting as much data at their registers, it would seem, the companies would significantly improve their ability to protect against such attacks, but the issue isn't that simple. In order to protect themselves against fraud on the part of customers -- primarily in the form of inappropriate returns -- the companies are forced to store some form of identification data, typically a credit card number -- to prevent the need to write off even more losses to crime. Among the databases of information scooped from TJX were some that carried such returns information. As a result, retail companies find themselves in a tricky situation where they are being forced to consider alternatives that allow them to reduce the level of customer data collected at the point-of-sale, while retaining enough information to protect against fraud. Flashback to the early 1990s, and video game console maker Nintendo was dealing with a challenging business problem. The Kyoto, Japan-based electronics company was selling millions of its NES video game consoles, but it was also being routinely fleeced by customers via fraudulent returns. Typically such transactions would involve people who would buy new gaming systems, place older, broken consoles in the new box, and then simply return the devices for a full refund. The company was losing large amounts of money and dealing with retailers who were shipping back scads of the worn-out machines, and attempts to implement manual guidelines, such as collecting more detailed data about customers, failed to deliver results. Faced with mounting costs, the company decided to employ a technological strategy for warding off fraudulent activity. By capturing the information on each box carrying each one of its consoles and creating an electronic receipt based on its UPC code and serial number at the point-of-sale, the firm discovered, it could build a database of pertinent information that would allow it to track sales without retaining customer data. By recording the information on the box, along with details about the retailer who sold it -- such as their geographic location and store number -- along with the date and time of an item's sale, Nintendo found that it could prevent many attempted returns that involved fraudulent behavior. The system was piloted at Wal-Mart in 1995, and rapidly expanded into other retailers worldwide. The company soon realized it had a hit on its hands when its largest rival at the time, Sega, came calling after hearing how well the system worked from its own retail partners. As a result, Nintendo decided to spin off the technology into its own company, Siras, in 1999. With massive manufacturers including General Electric, Hewlett-Packard, Philips and Sony, and retailers such as Best Buy, CompUSA, Sears and Target using the Siras Electronic Registration system today, the company maintains it provides an easy solution to the point-of-sale data collection nightmare presently facing retailers. By eliminating the need to collect customer data, including credit card numbers, said company officials, Siras feels it can also allow retailers and manufacturers to protect themselves from information exposure incidents and all the related fallout such events may bring. "Once consumer data is collected it's really just a matter of time before it gets exposed or stolen, and you don't need to be a sophisticated hacker to commit such a crime, a lot of times it's a retail employee who finds a way to capture the data and sell it," said Peter Junger, president of Siras, based in Redmond, Wash. "Meanwhile, many point-of-sale systems can be easily hacked, and radio frequency ID tools that aim to help solve these problems are still many years away." By purposefully avoiding the collection of personal data using a system such as Siras', companies can already begin lowering their risk while streamlining the retail shopping and returns process for themselves and their customers, he said. After collecting the UPC and sales information, the data is transmitted to a national database presided over by Siras, allowing the software maker to handle much of the legwork and eliminate related point-of-sale management costs for retailers, according to Junger. Siras is also in the process of developing other iterations of Electronic Registration for use by law enforcement officials tracking the movement of stolen goods, and for pawn shops and online auction sites that are trying to reduce sales of misappropriated or counterfeit goods. "It's a very simple technological approach to a complex problem," Junger said. "And we're hoping that someday its use will stretch far beyond electronics and other high-end items into almost any type of products that carries a serial number." One company already using Siras' tools is the consumer products division of Philips Electronics North America, the New York based manufacturer of everything from desktop computers to flat-screen TVs. Prior to implementing Siras in 2001, Philips dealt with the same sorts of issues that drove Nintendo to create the technology, but since that time, consumer fraud has been cut significantly, said Tony Sciarrotta, director of returns management for Phillips Consumer Electronics. "It's had a huge bottom-line impact, helping us save not just on the cost of fraudulently returned products, but also the need to reimburse retailers who get victimized," Sciarrotta said. "The consumer information is not attached to registration, which is a huge win for consumers who have concerns about privacy, and for retailers afraid of a breach incident, and the technology can be applied to almost anything you want to sell." Sciarrotta said that he would like to see larger numbers of retailers adopt Siras, and that he believes such tools should be required across the industry to lower the risk of consumer data loss. "There are certainly times when we would like to have a lot more consumer information, but that's not in the best interest of everyone involved, so we need to get it in other ways such as encouraging product registration after the sale," he said. "From our side we don't want to be the police or the gatekeeper, we want to allow our retailers to go about their business as easily as possible with the least amount of risk for loss; over all my years in this industry, this is one of the best ideas I've ever seen along those lines."
501614
US regulators yesterday accused Walt Disney of violating securities laws by failing to disclose compensation given to relatives of its directors and payments
555292
Online technology retailer Geeks.com displays a security vendor's "Hacker Safe" logo on its Web site. But now it's warning customers of a possible data compromise.
81781
Disney settles with the SEC for failing to inform investors of some familiar ties.
412634
Laptop with employee information stolen from Home Depot manager's car.
565561
Part deux An online choccy emporium has defended its response to a privacy glitch that left customer details unwrapped and exposed to the world.â¦
395819
It's a case of the professional fraudsters scamming the amateurs with a phishing tools supply site.
375551
The vendor issued an alert to some customers, telling them to run the flawed application in order to get it fixed.
535315
Hackers stole millions of credit card numbers from discount retailer TJX Cos. by intercepting wireless transfers of customer information at two Miami-area Marshalls stores, according to an eight-month investigation by the Canadian government.
604098
Hackers apparently used fake job listings to trick employees at the U.S. Department of Transportation and several U.S. firms into downloading malware that collected and stole sensitive information, according to British Internet security provider Prevx Ltd.
479926
(InfoWorld) - A subcontractor working for a company that processes and fulfills orders for the Disney Movie Club sold credit card numbers and other account information belonging to an unknown number of customers to undercover law enforcement agents. The May 2007 incident has prompted Disney to send out letters to an unspecified number of customers informing them about the breach. Disney did not respond to requests for comment about the incident. But Brad Van Duser, an Atlanta-based customer of the company's movie club, received the letter and made it available to Computerworld. The letter is dated July 6 and signed by John Flynn, vice president of online digital and directing marketing for Buena Vista Home Entertainment, a division of The Walt Disney Co. In it, Flynn said the incident involved an employee at Alta Resources Inc., a Neenah, Wis.-based outsourcer working for Disney. According to Flynn, the employee sold credit card information including names, addresses, credit card numbers and expiration dates to law enforcement authorities in an undercover sting operation. Flynn said Disney had been assured that card security codes, such as the CVV code, had not been compromised in the incident. "Law enforcement officials have informed us that there is no indication that your information was used to make improper purchases or sold to anyone other than federal law enforcement agents," Flynn said in his letter. "Nevertheless, in an abundance of caution, we have informed representatives of Visa, MasterCard, American Express and Discover of these events." The letter urged recipients to contact the financial institutions that issued their credit cards if they had any questions regarding their accounts. But it did not mention any free credit monitoring services, an option many companies have offered in similar situations. Van Duser said he was surprised by the incident. "As a customer, what surprised me the most was that even after all of the security breaches reported in the news recently that a large, reputable company like Disney had not taken steps to thoroughly protect my credit card information," he said in an e-mail. "And then when the breach occurred, they didn't offer a credit monitoring or other service." The Disney incident is the latest in a seemingly endless stream of breaches being disclosed by major companies this summer. Just this week it was disclosed that Kingston Technologies Inc., a maker of computer memory technologies, sent out letters to about 27,000 customers in connection with a September 2005 data breach that the company did not discover until recently. Western Union made a similar disclosure, announcing that it was notifying about 20,000 customers of a potential compromise of their personal data following the discovery of a database intrusion. Such incidents have heightened consumer concerns and pushed several states to consider or enact laws requiring retailers and other entities handling credit card data to implement safeguards for protecting the data. One of the most closely watched of these laws is California's proposed AB 779 legislation, which would require breached entities such as Disney to disclose more details about security breaches, including a description of the categories of personal data that might have been compromised. In addition, the law would also hold breached entities financially liable for the costs incurred by banks and credit unions to notify customers of a breach and to subsequently block and reissue cards.
446155
New software helps corporate travel managers track down business travelers who overspend. But it also poses a dilemma for honest travelers who are only trying to save money.