What could be even worse than getting hacked?
It’s the “failure to detect intrusions” that always results in huge losses to the organisations.
Utah-based technology company InfoTrax Systems is the latest example of such a security blunder, as the company was breached more than 20 times from May 2014 until March 2016.
What’s ironic is that the company detected the breach only after it received an alert that its servers had reached maximum storage capacity due to a data archive file that the hacker created.
InfoTrax Systems is an American company based in Utah that provides backend operations systems to multi-level marketers, which also includes an extensive amount of sensitive data on their users’ compensation, inventory, orders, and accounting.
The breach reportedly occurred in May 2014 when the hacker exploited vulnerabilities in InfoTrax’s server and its client’s website to gain remote control over its server, allowing him to gain access to sensitive personal information for 1 million consumers.
At the time, the United States Federal Trade Commission (FTC) sued the company for failing to safeguard the personal information the company maintained on behalf of its clients.
According to the FTC complaint, the hacker remotely accessed the system 17 times over the next 21 months without being detected and then began pulling the personal information of consumers on March 2, 2016.
The stolen information included customers’ full names, social security numbers, physical addresses, email addresses, telephone numbers, usernames, and passwords for 4100 distributor and admin accounts on the InfoTrax service.
What’s even worse? The leaked data also included some customers’ payment card information (full or partial credit card and debit card numbers, CVVs, and expiration dates), as well as bank account information, including account and routing numbers.
The company discovered the breach on March 7, 2016, when it began receiving alerts that one of its servers had reached its maximum capacity, which was due to a massive data archive file that the hacker created on its customers.
Surprisingly, the intruder managed to breach the company at least two more times even after InfoTrax Systems became aware of the intrusion.
images from Hacker News
Recent Comments