A Georgia man has pleaded guilty to fraud and identity theft after
authorities found him in possession of more than 675,000 credit card
numbers, some of which he obtained by hacking into business networks
Rogelio Hackett Jr., 26, pleaded guilty on Thursday to one count each of
access device fraud and aggravated identity theft after authorities
executed a search warrant at his home and discovered the card numbers,
used to conduct fraudulent transactions totaling more than $36 million, on
his computers and storage devices.
According to the indictment, authorities hunted Hackett down after
monitoring his activity in internet relay chat (IRC) rooms and on
underground forums, where he sold stolen card numbers, usually at $20 to
$25 each to buyers around the world. He used the proceeds to make high-end
purchases, such as a 2001 BMW X5 and a pair of $450 Louis Vuitton shoes.
Wednesday, April 27, 2011
Only four fines over data breaches
Just four civil penalties have been handed out by the information
watchdog since the powers came into force last year, with a company
that lost information relating to more than 20,00 people in Leicester
and Hull fined, figures show.
More than 2,500 possible breaches of the Data Protection Act have been
reported to the Information Commissioner's Office (ICO), but just 36
have resulted in any action and only four have attracted civil
penalties.
In all, organisations have been fined a total of just £310,000, with
the biggest fine handed out to date being £100,000 - despite the
maximum penalty for a single offence being £500,000.
The figures, released to encryption firm ViaSat under Freedom of
Information laws, also showed that the ICO has taken action against
seven private sector organisations, penalising just one, but 29 in the
public sector, penalising three.
Chris McIntosh, the firm's chief executive, said: "The ICO has a
tremendous amount of leeway in the penalties it levies and so far
doesn't seem to be applying this in either direction.
"The ICO has stated that the embarrassment and poor image of a fine
will act as a deterrent and an incentive to improve an organisation's
grasp of the Data Protection Act. However, if fines are rare and well
below the maximum allowed limit, their value as a deterrent drops.
"Organisations will view the rarity of a fine and the associated
negative publicity the same way they have viewed the threat of a data
breach itself: an event that only happens to other people."
The biggest fine to date, £100,000, was given to Hertfordshire County
Council in November last year after it accidentally faxed highly
sensitive information about cases involving child sex abuse and care
proceedings to the wrong recipients on two occasions in the space of
two weeks in June 2010.
In February, Ealing Council was fined £80,000 and Hounslow Council was
fined £70,000 after an out-of-hours service working on behalf of both
councils lost two laptops containing the details of around 1,700
people when they were stolen from an employee's home. Almost 1,000 of
the individuals were clients of Ealing Council and almost 700 were
clients of Hounslow Council.
And also in November, employment services company A4e was fined
£60,000 over the theft of a laptop containing personal information of
about 24,000 people who had used community legal advice centres in
Hull and Leicester in June.
watchdog since the powers came into force last year, with a company
that lost information relating to more than 20,00 people in Leicester
and Hull fined, figures show.
More than 2,500 possible breaches of the Data Protection Act have been
reported to the Information Commissioner's Office (ICO), but just 36
have resulted in any action and only four have attracted civil
penalties.
In all, organisations have been fined a total of just £310,000, with
the biggest fine handed out to date being £100,000 - despite the
maximum penalty for a single offence being £500,000.
The figures, released to encryption firm ViaSat under Freedom of
Information laws, also showed that the ICO has taken action against
seven private sector organisations, penalising just one, but 29 in the
public sector, penalising three.
Chris McIntosh, the firm's chief executive, said: "The ICO has a
tremendous amount of leeway in the penalties it levies and so far
doesn't seem to be applying this in either direction.
"The ICO has stated that the embarrassment and poor image of a fine
will act as a deterrent and an incentive to improve an organisation's
grasp of the Data Protection Act. However, if fines are rare and well
below the maximum allowed limit, their value as a deterrent drops.
"Organisations will view the rarity of a fine and the associated
negative publicity the same way they have viewed the threat of a data
breach itself: an event that only happens to other people."
The biggest fine to date, £100,000, was given to Hertfordshire County
Council in November last year after it accidentally faxed highly
sensitive information about cases involving child sex abuse and care
proceedings to the wrong recipients on two occasions in the space of
two weeks in June 2010.
In February, Ealing Council was fined £80,000 and Hounslow Council was
fined £70,000 after an out-of-hours service working on behalf of both
councils lost two laptops containing the details of around 1,700
people when they were stolen from an employee's home. Almost 1,000 of
the individuals were clients of Ealing Council and almost 700 were
clients of Hounslow Council.
And also in November, employment services company A4e was fined
£60,000 over the theft of a laptop containing personal information of
about 24,000 people who had used community legal advice centres in
Hull and Leicester in June.
Privacy breach case is settled - Restaurant group to pay Mass. $110, 000
The Briar Group, which runs Ned Devine’s, the Green Briar, the Lenox,
and other popular restaurants, has agreed to pay $110,000 to resolve
allegations that the Boston chain failed to take reasonable steps to
protect diners’ personal information and put at risk tens of thousands
of credit and debit card accounts.
The settlement stems from a lawsuit filed by Massachusetts Attorney
General Martha Coakley over a data breach the Briar Group suffered in
April 2009. Briar’s failure to implement basic data security measures
enabled hackers to access customers’ credit and debit card
information, including names and account numbers, according to the
lawsuit. The hackers’ malware — malicious software designed to
infiltrate computer systems — that caused the security problems was
not removed from the company’s computers until December 2009.
The lawsuit filed in Suffolk Superior Court also alleges that the
Briar Group failed to change default usernames and passwords on its
point-of-sale computer system; allowed multiple employees to share
common usernames and passwords; failed to properly secure its remote
access utilities and wireless network; and continued to accept credit
and debit cards from consumers after Briar knew of the data breach.
“The Briar Group is committed to high-quality customer service at all
of our restaurants. We take the security of our customer’s credit card
information very seriously and therefore respond aggressively to any
concerns that are brought to our attention,’’ the restaurant chain
said in a statement. “We believe the agreement we have entered into
with the attorney general’s office achieves our shared goal of
ensuring that our customers can use their credit cards with confidence
in the security of their data.’’
But the Briar Group added in its statement that it believes it chain
acted immediately once it was informed of the possible breach.
“We took immediate and aggressive action steps, including: informing
the major credit card companies of the potential breach, working with
the nation’s leading data security company to identify any weaknesses
in our data systems and make system upgrades to further secure
customer data and cooperating with a federal investigation into this
matter,’’ the statement said. “We are confident that customers dining
at one of our restaurants can safely use their credit cards.’’
Under the terms of the settlement, the Briar Group must pay the
Commonwealth $110,000 in civil penalties; comply with state data
security regulations and Payment Card Industry Data Security
Standards; and maintain an enhanced computer network security system.
“When consumers use their credit and debit cards at Massachusetts
establishments, they have an expectation that their personal
information will be properly protected,’’ Coakley said in a statement.
“In addition to the payment, this agreement also works to ensure that
steps have been taken to protect consumer information moving
forward.’’
and other popular restaurants, has agreed to pay $110,000 to resolve
allegations that the Boston chain failed to take reasonable steps to
protect diners’ personal information and put at risk tens of thousands
of credit and debit card accounts.
The settlement stems from a lawsuit filed by Massachusetts Attorney
General Martha Coakley over a data breach the Briar Group suffered in
April 2009. Briar’s failure to implement basic data security measures
enabled hackers to access customers’ credit and debit card
information, including names and account numbers, according to the
lawsuit. The hackers’ malware — malicious software designed to
infiltrate computer systems — that caused the security problems was
not removed from the company’s computers until December 2009.
The lawsuit filed in Suffolk Superior Court also alleges that the
Briar Group failed to change default usernames and passwords on its
point-of-sale computer system; allowed multiple employees to share
common usernames and passwords; failed to properly secure its remote
access utilities and wireless network; and continued to accept credit
and debit cards from consumers after Briar knew of the data breach.
“The Briar Group is committed to high-quality customer service at all
of our restaurants. We take the security of our customer’s credit card
information very seriously and therefore respond aggressively to any
concerns that are brought to our attention,’’ the restaurant chain
said in a statement. “We believe the agreement we have entered into
with the attorney general’s office achieves our shared goal of
ensuring that our customers can use their credit cards with confidence
in the security of their data.’’
But the Briar Group added in its statement that it believes it chain
acted immediately once it was informed of the possible breach.
“We took immediate and aggressive action steps, including: informing
the major credit card companies of the potential breach, working with
the nation’s leading data security company to identify any weaknesses
in our data systems and make system upgrades to further secure
customer data and cooperating with a federal investigation into this
matter,’’ the statement said. “We are confident that customers dining
at one of our restaurants can safely use their credit cards.’’
Under the terms of the settlement, the Briar Group must pay the
Commonwealth $110,000 in civil penalties; comply with state data
security regulations and Payment Card Industry Data Security
Standards; and maintain an enhanced computer network security system.
“When consumers use their credit and debit cards at Massachusetts
establishments, they have an expectation that their personal
information will be properly protected,’’ Coakley said in a statement.
“In addition to the payment, this agreement also works to ensure that
steps have been taken to protect consumer information moving
forward.’’
Epsilon pledges to build 'Fort Knox' around breached system
E-mail marketing giant Epsilon will build an industry-leading security
system in response to a March 30 breach in which thieves gained access
to the e-mail addresses and names of partner's customers, the CEO of
Epsilon's parent company said Thursday.
Epsilon had "very strong" security measures in place before the
breach, but additional improvements are coming, said Ed Heffernan,
president and CEO of Alliance Data Systems.
"Bottom line, we will emerge not just with strong security protocols,
but industry-leading," he said. "We're essentially going to build Fort
Knox around this thing. We've taken the position now that it's not
good enough to be at or above the industry [standard], we need to be
the absolute leader in the industry because we are the largest
player."
Epsilon's e-mail marketing technologies will sacrifice some
flexibility and user-friendliness for security, Heffernan said during
a conference call about his company's quarterly profits. Heffernan
didn't disclose what new security measures the company planned to
take.
The breach affected about 2 percent of Epsilon's clients. Heffernan
said. Best Buy, JPMorgan Chase and the Kroger supermarket chain were
among the Epsilon clients that warned their customers about the
breach.
Several clients have expressed frustration over the incident,
Heffernan said. The company plans to do "whatever it takes" to restore
relationships with clients, he said.
"While knowing we are the victim of this crime, we will not be playing
that card," he said. "Rather, we view our role as standing up and
taking the hit for what these cyber-crooks did. We will learn from the
experience and come out stronger than ever."
Still, Alliance Data Systems projected no "meaningful" costs or
liability related to the incident, Heffernan said. E-mail volumes have
remained at the expected levels, and the company expects no changes in
Epsilon's financial results going forward.
The company expects the "vast, vast majority, if not all," of
Epsilon's clients to remain with the company, he said. Client
retention will be a top priority at Epsilon moving forward, company
officials said.
The company detected "abnormalities" in its e-mail marketing system on
March 30 and began notifying clients and U.S. law enforcement
officials within 24 hours, Heffernan said.
Heffernan declined to discuss details of the breach.
Epsilon's investigation found that e-mail addresses and names were
stolen, but no personally identifiable information (PII), such as
account numbers or credit card numbers, he said.
"Stolen e-mail addresses are certainly bad, but stolen PII is what we
would call really, really bad," he said.
Alliance Data Systems officials called their first quarter earnings
"strong." Epsilon's revenue increased 23 percent to $156 million from
the first quarter of 2010. The breach happened one day before the
first quarter ended.
system in response to a March 30 breach in which thieves gained access
to the e-mail addresses and names of partner's customers, the CEO of
Epsilon's parent company said Thursday.
Epsilon had "very strong" security measures in place before the
breach, but additional improvements are coming, said Ed Heffernan,
president and CEO of Alliance Data Systems.
"Bottom line, we will emerge not just with strong security protocols,
but industry-leading," he said. "We're essentially going to build Fort
Knox around this thing. We've taken the position now that it's not
good enough to be at or above the industry [standard], we need to be
the absolute leader in the industry because we are the largest
player."
Epsilon's e-mail marketing technologies will sacrifice some
flexibility and user-friendliness for security, Heffernan said during
a conference call about his company's quarterly profits. Heffernan
didn't disclose what new security measures the company planned to
take.
The breach affected about 2 percent of Epsilon's clients. Heffernan
said. Best Buy, JPMorgan Chase and the Kroger supermarket chain were
among the Epsilon clients that warned their customers about the
breach.
Several clients have expressed frustration over the incident,
Heffernan said. The company plans to do "whatever it takes" to restore
relationships with clients, he said.
"While knowing we are the victim of this crime, we will not be playing
that card," he said. "Rather, we view our role as standing up and
taking the hit for what these cyber-crooks did. We will learn from the
experience and come out stronger than ever."
Still, Alliance Data Systems projected no "meaningful" costs or
liability related to the incident, Heffernan said. E-mail volumes have
remained at the expected levels, and the company expects no changes in
Epsilon's financial results going forward.
The company expects the "vast, vast majority, if not all," of
Epsilon's clients to remain with the company, he said. Client
retention will be a top priority at Epsilon moving forward, company
officials said.
The company detected "abnormalities" in its e-mail marketing system on
March 30 and began notifying clients and U.S. law enforcement
officials within 24 hours, Heffernan said.
Heffernan declined to discuss details of the breach.
Epsilon's investigation found that e-mail addresses and names were
stolen, but no personally identifiable information (PII), such as
account numbers or credit card numbers, he said.
"Stolen e-mail addresses are certainly bad, but stolen PII is what we
would call really, really bad," he said.
Alliance Data Systems officials called their first quarter earnings
"strong." Epsilon's revenue increased 23 percent to $156 million from
the first quarter of 2010. The breach happened one day before the
first quarter ended.
ICO Slaps Oldham School, But Suffers Fresh Criticism
Information Commissioner tells a teacher off for losing a laptop, but
critics say this is not enough
The Information Commissioner has reprimanded a school and a hospital
for data breaches, but is still facing criticism for going too easy on
organisations failing to protect their data.
Freehold Community School in Oldham, may have exposed 90 pupils’
personal information when an unencrypted laptop was stolen from a
teacher’s car, while NHS Birmingham East and North breached the Data
Protection Act by failing to restrict access to files on its IT
network, the Information Commissioner’s Office (ICO) has said.
The announcements came while the ICO was slated for acting on data
breaches so rarely that its fines are “a risk organisations are
prepared to take,” according to critics.
Public sector still unfairly targeted?
The ICO has only fined four organisations for data breaches, despite
having 2565 incidents reported to it in the year since it gained the
right to fine offender, according to a Freedom of Information request
made by security firm ViaSat.
ICO deputy director David Smith attacked the figures when they were
released, calling them “inaccurate”, and suggested a revision downward
to around 600 reported breaches. ViaSat stood by the figures, pointing
out that the data came from the ICO in response to a specific request
about data breaches.
“Our request was clear in that we wanted information on the number of
data breaches,” said ViaSat chief executive Chris McIntosh. “Even if
you look at the revised figures the ICO has released it is still clear
that that monetary penalties have been enforced in less than one
percent of the data losses it has dealt with.”
The new reprimands did not include fines, and do nothing to counter
McIntosh’s other criticism, that the ICO hits the public sector
unfairly. “The public sector… dutifully reports its failures under the
data protection act and receives more, and larger, penalties as a
result,” said McIntosh in a statement.
Promise to do better
Joyce Willetts, the head of Freehold Community School, has promised
that laptops will not be stored in cars in future, all data taken off
site will be encrypted, and staff will be trained.
Meanwhile in Birmingham, Denise McLellan, chief executive of the NHS
Birmingham East and North trust has promised to increase security,
after the personal records of thousands of members of staff were
potentially exposed to staff at three NHS trusts.
“Our focus as a regulator is on getting bodies to comply with the Data
Protection Act,” said an ICO statement. “This isn’t always best
achieved by issuing organisations or businesses with monetary
penalties. The big stick is there, but doesn’t need to be deployed all
the time to have an effect.”
The ICO ’s guidance on the use of its powers to issue a monetary
penalty is here (PDF)
This statement did little to placate McIntosh, who reiterated his
criticism of ICO inaction: “The ICO is fond of saying that ‘you have
to be selective to be effective’ but by being too selective all that
happens is that organisations, especially in the private sector, can
begin to view the threat of a penalty or an undertaking as something
that is so unlikely as to be beneath notice,” he said. “For example,
organisations could easily look at the £60,000 penalty meted out to
A4e, its size compared to the company’s £145m turnover, its rarity and
the fact that A4e is still receiving plenty of business, from the
Government no less, and feel that the risk of ICO action is one they
are prepared to take.”
McIntosh and the ICO agree on one thing however. At Infosec Smith is
reported as asking for more powers to deal with those who breach the
data protection act.
McIntosh agrees: “The ICO is right to push for more powers, and we
fervently hope it can get them,” he said. “However, it would be nice
to see those it has exercised a little more.”
The ICO has indeed been given more powers in another area related to
data breaches. It can fine companies that send unwanted spam up to
£500,000.
critics say this is not enough
The Information Commissioner has reprimanded a school and a hospital
for data breaches, but is still facing criticism for going too easy on
organisations failing to protect their data.
Freehold Community School in Oldham, may have exposed 90 pupils’
personal information when an unencrypted laptop was stolen from a
teacher’s car, while NHS Birmingham East and North breached the Data
Protection Act by failing to restrict access to files on its IT
network, the Information Commissioner’s Office (ICO) has said.
The announcements came while the ICO was slated for acting on data
breaches so rarely that its fines are “a risk organisations are
prepared to take,” according to critics.
Public sector still unfairly targeted?
The ICO has only fined four organisations for data breaches, despite
having 2565 incidents reported to it in the year since it gained the
right to fine offender, according to a Freedom of Information request
made by security firm ViaSat.
ICO deputy director David Smith attacked the figures when they were
released, calling them “inaccurate”, and suggested a revision downward
to around 600 reported breaches. ViaSat stood by the figures, pointing
out that the data came from the ICO in response to a specific request
about data breaches.
“Our request was clear in that we wanted information on the number of
data breaches,” said ViaSat chief executive Chris McIntosh. “Even if
you look at the revised figures the ICO has released it is still clear
that that monetary penalties have been enforced in less than one
percent of the data losses it has dealt with.”
The new reprimands did not include fines, and do nothing to counter
McIntosh’s other criticism, that the ICO hits the public sector
unfairly. “The public sector… dutifully reports its failures under the
data protection act and receives more, and larger, penalties as a
result,” said McIntosh in a statement.
Promise to do better
Joyce Willetts, the head of Freehold Community School, has promised
that laptops will not be stored in cars in future, all data taken off
site will be encrypted, and staff will be trained.
Meanwhile in Birmingham, Denise McLellan, chief executive of the NHS
Birmingham East and North trust has promised to increase security,
after the personal records of thousands of members of staff were
potentially exposed to staff at three NHS trusts.
“Our focus as a regulator is on getting bodies to comply with the Data
Protection Act,” said an ICO statement. “This isn’t always best
achieved by issuing organisations or businesses with monetary
penalties. The big stick is there, but doesn’t need to be deployed all
the time to have an effect.”
The ICO ’s guidance on the use of its powers to issue a monetary
penalty is here (PDF)
This statement did little to placate McIntosh, who reiterated his
criticism of ICO inaction: “The ICO is fond of saying that ‘you have
to be selective to be effective’ but by being too selective all that
happens is that organisations, especially in the private sector, can
begin to view the threat of a penalty or an undertaking as something
that is so unlikely as to be beneath notice,” he said. “For example,
organisations could easily look at the £60,000 penalty meted out to
A4e, its size compared to the company’s £145m turnover, its rarity and
the fact that A4e is still receiving plenty of business, from the
Government no less, and feel that the risk of ICO action is one they
are prepared to take.”
McIntosh and the ICO agree on one thing however. At Infosec Smith is
reported as asking for more powers to deal with those who breach the
data protection act.
McIntosh agrees: “The ICO is right to push for more powers, and we
fervently hope it can get them,” he said. “However, it would be nice
to see those it has exercised a little more.”
The ICO has indeed been given more powers in another area related to
data breaches. It can fine companies that send unwanted spam up to
£500,000.
Sealed Records Exposed In Major Court Gaffe
In a shocking failure to protect sensitive details about dozens of ongoing
criminal investigations, federal officials somehow allowed confidential
information about sealed cases to be publicly accessible via the court
system.s online lookup service, The Smoking Gun has learned.
Over the past nine months, details of 40 separate sealed court
applications filed by federal prosecutors in Alabama were uploaded to
PACER, the web-based records system that counts nearly one million users,
including defense lawyers, prosecutors, journalists, researchers, private
investigators, and government officials.
The court applications, made by ten separate prosecutors, included
requests to install hidden surveillance cameras, examine Facebook records,
obtain credit information on certain individuals, procure telephone
records, and attach devices on phone lines that would allow agents to
track incoming and outgoing calls. Remarkably, the U.S. District Court
records--which covered filings as recent as April 11--included specific
names, addresses, and phone numbers that should never have appeared on
PACER.
criminal investigations, federal officials somehow allowed confidential
information about sealed cases to be publicly accessible via the court
system.s online lookup service, The Smoking Gun has learned.
Over the past nine months, details of 40 separate sealed court
applications filed by federal prosecutors in Alabama were uploaded to
PACER, the web-based records system that counts nearly one million users,
including defense lawyers, prosecutors, journalists, researchers, private
investigators, and government officials.
The court applications, made by ten separate prosecutors, included
requests to install hidden surveillance cameras, examine Facebook records,
obtain credit information on certain individuals, procure telephone
records, and attach devices on phone lines that would allow agents to
track incoming and outgoing calls. Remarkably, the U.S. District Court
records--which covered filings as recent as April 11--included specific
names, addresses, and phone numbers that should never have appeared on
PACER.
Carder Pleads Guilty to Fraud Involving $36 Million in Losses
A hacker and carder has pleaded guilty to trafficking in more than half a
million stolen card numbers that resulted in $36 million in fraud losses.
Rogelio Hackett, Jr., 26, pleaded guilty Thursday in Virginia to one count
of access device fraud and one count of aggravated identity theft.
The hacker was arrested in 2009 for selling stolen bank card numbers in
online criminal forums and IRC chatrooms. When authorities searched his
home at the time, they found more than 675,000 stolen credit card numbers
on his computers and in e-mail accounts. According to court records
(.pdf), more than $36 million in fraudulent transactions have been
attributed to the stolen numbers found in Hackett?s possession.
Authorities don?t say how many of these transactions were committed by him
or by others.
Hackett, who hails from Lithonia, Georgia, admitted that he had been
hacking computers since the late 1990s, an activity that morphed into
hacking-for-profit by 2002 when he began stealing bank card data from SQL
databases. In August 2007, for example, he breached the server at an
unnamed online ticket seller and stole information on about 360,000 credit
card accounts. He still had the data on his computer two years later when
authorities searched his home.
million stolen card numbers that resulted in $36 million in fraud losses.
Rogelio Hackett, Jr., 26, pleaded guilty Thursday in Virginia to one count
of access device fraud and one count of aggravated identity theft.
The hacker was arrested in 2009 for selling stolen bank card numbers in
online criminal forums and IRC chatrooms. When authorities searched his
home at the time, they found more than 675,000 stolen credit card numbers
on his computers and in e-mail accounts. According to court records
(.pdf), more than $36 million in fraudulent transactions have been
attributed to the stolen numbers found in Hackett?s possession.
Authorities don?t say how many of these transactions were committed by him
or by others.
Hackett, who hails from Lithonia, Georgia, admitted that he had been
hacking computers since the late 1990s, an activity that morphed into
hacking-for-profit by 2002 when he began stealing bank card data from SQL
databases. In August 2007, for example, he breached the server at an
unnamed online ticket seller and stole information on about 360,000 credit
card accounts. He still had the data on his computer two years later when
authorities searched his home.
Subscribe to:
Posts (Atom)