My wife is a big fan of movies produced by one of the major film & entertainment companies [I'd like to share the company name but to be honest, I don't need the hassles]. As a result she joined one of their movie clubs.
We all know movie/music/book clubs are a hassle but you expect to have difficulties with them and you accept it. What we didn't expect was this letter we received yesterday regarding a security problem at the vender who provides order fulfillment for the movie club.
One of [order fulfillment company]'s employee's sold certain credit card information to federal law enforcement agents, as part of an undercover sting operation. The information included your name, address, credit card number, and expiration date, and credit card type, and may have included your telephone number and email address if you provided that contact information to us [which we did].
I'm like WTF?!?! This thievery wasn't the result of a hacker, firewall breach, or any other technical attack. An employee simply copied the data and sold it.
The letter goes on to say a bunch of things that I guess are supposed to make me feel better…
The individual involved in this incident is no longer employed by [order fulfillment company] and no longer has access rights to [order fulfillment company]'s premises or computer systems. You should also know that [order fulfillment company] now has taken additional corrective and precautionary measures, and has been independently certified under the Payment Card Industry (PCI) Data Security Standard1, an industry standard for the safeguarding of consumer credit card information.
I sure hope the person that committed the crime no longer has access - geez!!
Also - now I don't know this for sure - but I imagine that [order fulfillment company] was already certified by the PCI Data Security Standard before this incident since the major credit card companies expect organizations that handle credit card info to be certified under this standard. And I certainly hope that the film & entertainment company requires [order fulfillment company] and any other vendors that handle credit card information to comply with the standard.
An issue that really bugs me is that one of the key tenants of the PCI Data Security Standard is that credit card information be available to only those employees who have a business need to know. I can't imagine why the person who sold this information would have a business need to know our complete credit card info and accompanying personal info; we're account holders in good standing with both the credit card company and the movie club.
I guess no real point to this rant - It just amazes me that such simple, human-based thievery is still so easily achieved. Why didn't [order fulfillment company] protect this information? More importantly, why didn't the major film & entertainment company require the fulfillment provider to demonstrate and certify adequate data protection?
The film & entertainment company is one of the biggest in the world; I gotta believe that had they taken security of this data with the seriousness that it deserves that they would've required the [order fulfillment company] to provide adequate security and sufficiently limited access to this data so as to avoid such simple thievery.
I wonder how many companies still make this kind'a data available to any employee who can type a SQL query.
--End of Rant --
1For a simple overview of the PCI Security Standard, checkout the PCI DSS page on Wikipedia
Posted
Jul 10 2007, 08:24 AM
by
jim-wilson