The recent breach of online retailer Batteries.com may have escaped your attention.

The Indiana-based company, according to a few reports, issued a letter to officials in New Hampshire indicating that hackers penetrated the Batteries.com network over a period of two months from February to April 2009. In the letter, the company indicated that 865 residents of New Hampshire had been victimized. Stolen data included customer names, addresses and credit card details.

Some of that data, Batteries.com says, was used for fraudulent purposes.

Information has yet to be released on how many victims there are outside of New Hampshire. But I don’t think a hacker would have a grudge only against residents of the “Live Free or Die” state. It’s safe to assume many more customers’ identities and credit card accounts have been affected.

Those customers will undoubtedly suffer severe headaches. Dealing with credit card companies. Credit bureaus. Banks. Automated phone systems. Paperwork. The list goes on.

One alleged Batteries.com customer on this message board said he had “thousands of charges” on his credit card from someone in the United Kingdom.

“(I)t looks like the operation is very sophisticated,” the poster says. “Some of the charges occurred within 1 second of each other and must have been automated because one of the companies, British Airways, indicated that they do not permit an airline ticket to be purchased by somebody and paid for by somebody else, and the card ‘looked’ like it was issued in the UK…I suspect thousands of other victims are seeing charges on their cards too.”

But Batteries.com, and any other merchant who is hacked like this, will also suffer severe headaches. First of all, the company will be issuing two years of free credit monitoring services to victims. Second, how many of these victims are likely to shop at Batteries.com again? And what about negative press coverage?

Further, can you imagine the amount of costly and time-consuming forensics work that goes into determining the details of two months worth of hackings?

As a merchant, if you are breached like this, you’ll pay a forensics auditor $250 an hour to spend days—many times several weeks—to pour through your “log” files, which register all events on your network. These auditors will conduct “reverse engineering” and scour your network for all sorts of data, such as if any users accessed your network from unusual locations. If your log files have been compromised, or not backed up properly, the process can even take longer.

An IT forensics audit is so complex that Visa has certified only seven vendors as “qualified incident response assessors.” (The data gathered during these audits, by the way, help companies such as Verizon Business, one of the seven assessors, publish great breach reports like this.)

An IT forensics audit, in many ways, is similar to a homicide forensics exam. But an IT audit can cost you $20,000 or more when it’s all said and done.

That may be good news for Visa’s qualified assessors. But for small merchants, a massive breach can be devastating.

‘Til Next Time,

Joan
The eSecurityDiva.

Remember the federal bust in early August that netted 11 hackers who allegedly stole more than 40 million credit card numbers? Now, The Wall Street Journal reports that many of the victims of those thefts were never even notified by the restaurants and retailers who were hacked.

This is true despite the fact that some 40 states have breach notification laws.

Only four of the nine companies that were hacked clearly notified their customers. The companies that did not – Boston Market, Forever 21, and possibly Barnes and Noble, Office Max and Sports Authority – had varying excuses. One excuse was that they never “confirmed” data was stolen, the WSJ says. Barnes and Noble, Office Max and Sports Authority, meanwhile, wouldn’t even say whether they made disclosures in the first place. (A WSJ investigation found no evidence of any disclosures).

I’m surprised how little PR backlash these companies have received. It’s not only law that says you have to notify customers in the event of a breach, but it is the ethical thing to do. The only reasonable debate is how that disclosure should happen.

However, four companies – TJX, BJ’s Wholesale Club, DSW and Dave and Busters – did notify customers shortly after the breaches were discovered. These companies deserve full credit for their actions, especially TJX. The clothing retailer has been lambasted for more than a year in the press since the disclosure in early 2007.

I’m well aware of the paradox here. The four retailers that allegedly were not proactive so far have received little condemnation. And some of the retailers who were proactive are now synonymous with the words “data breach.” Not very fair.

So, does that mean that doing the right thing isn’t always the best thing? I interviewed crisis management expert Dean Trevelino, owner of public relations firm Trevelino/Keller, on this very topic. To begin, he says, all retailers should follow these three steps:

1. Retailers big and small need to make the necessary investments in making sure they are as protected as possible. That, of course, means having a robust and consistent security policy in place. For smaller retailers, he says, these investments ought to be weighed with substantial thought next to the revenue they may be bringing in.
2. All retailers – even the smaller ones – need to have a basic crisis control plan in place. This includes a to-call list -- i.e. PR, legal and IT.
3. If it does happen, you “absolutely need to be forthcoming,” Trevelino says. That means a disclosure within 48 hours. But he adds that no disclosure should occur if you don’t have a clear handle on how it happened. “Grab the smartest people you can find and drill down on the causes and solutions to the problem,” he says. “Once you do that, let effected customers know ASAP what they should do and what you are doing to solve the problem," he adds.

So what about the paradox? Trevelino sums it nicely:

While TJX received its fair share of bad press, the worst is over. In fact, he says, the companies on the up-and-up may be viewed rather positively, now that the thieves have been busted. In contrast, for Boston Market and the rest of them, the worst is likely yet to come.

“It’s a heck of a road back if you’re weak from a security standpoint and not forthcoming,” Trevelino says. “People will forgive you if you didn’t have enough security, especially nowadays – you’re simply just one of the many victims. But if you’re a victim and not forthcoming, that’s a difficult thing to recover from.”

I recently sent some employees to an (ISC)² seminar to get an industry-recommended security certificate. The seminar is aimed at providing education on the newest and hottest cyber threats.

With all the news of mega breaches out there, including one I just wrote about in this blog, it would seem as if an information-packed seminar such as this one would be packed with IT people, right? Actually, it was. But with public sector IT people. Private sector attendees were few and far between.

What’s going on here? This little piece of news could be a telltale:

According to a new report by the Identity Theft Resource Center, the percentage of breaches occurring in the government sector has been dropping steadily over the past three years. The percentage of breaches occurring in the private sector, meanwhile, has skyrocketed 69 percent from the same six-month period last year. Mix that news with the fact that the private sector is substantially less prone to reporting breaches than the public sector and the situation gets even worse.

As the report indicates, the government sector – for a change – is outperforming the private sector. The report says during the first half of this year, breaches in the government accounted for only 17 percent of all reported breaches, a 13 percentage point decrease from 2006.

Leading the seminar was Bill Lipiczky, a senior architect with IT consultancy Managed By Design. He acknowledges the lopsided attendance record, estimating that the private sector accounted for only 20 percent of the class. He says companies often do not have as full a grasp on cyber threats as it should.

“They don’t have a good handle on the risk,” Lipiczky says. “I kind of liken it to life insurance.”

Life insurance. Kind of like not really thinking about bad things until something bad happens.

To be fair, Lipiczky points out that the government’s emphasis may be because it has more pressing things to worry about than simply identity theft. Like national security, for one. Stuff like foreign governments trying to hack into our critical systems. But something clearly has to be done here. The number of breaches cannot continue spiraling out of control without the Congress getting involved more than it already is. Do we really want that?

So, I have a challenge. Let’s start attending more professional development courses like the one offered by Lipiczky. Let’s start being more proactive about preventing breaches. And let’s show that we can do the right thing without being legislated to do so.

‘Til Next Time,

Joan,
The eSecurityDiva

Six months. That’s how long it took for one of the nation’s oldest retailers to commit to coming clean about a hacking incident that compromised at least 51,000 records.

The retailer, Montgomery Ward, was recently quoted in an AP story saying it would contact the people affected by the incident, believed to have taken place back in December. That commitment only occurred after the reporter asked a Montgomery Ward exec if he was going to let the victims in on the secret.

Surprisingly, 44 states have some form of notification mandate when such occurrences arise. Regardless, research firm Gartner believes unreported breaches probably outnumber the reported ones. Fear of negative publicity is the No. 1 reason why so many are swept under the covers. Remember the firestorm resulting from the breach at TJX?

It appears that common point of purchase (CPP as it’s called in the trade) analysis led the victims and the AP to the discovery. According to the story, an investigative firm focusing on payment card theft noticed in June that alleged hackers were offering the sale of some 200,000 payment cards in online chat rooms frequented by assorted cyber criminals. Data was also available on the card holders’ security codes, expiration dates, addresses and phone numbers.

However, Montgomery Ward knew about the incident in December. The company followed Visa’s “guidelines” to a T. That included a report to the U.S. Secret Service. But according to the story, the guidelines did not include notifying customers.

Only 15 percent of identity theft victims learn they are breached from the company responsible for it, according to the Identity Theft Research Center. That means the rest find out the hard way.

It appears many companies would rather roll the dice on being caught by states rather than being proactive about disclosure which, to some extent, is understandable. After all, backlash from such an event could prove fatal for a small company. It’s also fully understandable (not in Ward’s case) that firms often don’t even know they’ve been breached, particularly the ones that don’t have security and PCI compliance partners.

I’m curious. Imagine for a minute your company’s database or Website has been hacked. Now imagine the breach was substantial, perhaps compromising 80 percent of your customers’ records. What’s the best way to handle such a crisis, knowing full well that negative publicity could be catastrophic? What roles should the credit card companies, processors and merchants play in this unsavory process?

‘Til Next Time,

Joan
The eSecurity Diva