RE: reporting a web site breach

["Bob Woods" <bwoods () atlantiscasino com>]

If any of the names were California residents, you may wish to contact
California law enforcement officials, because their failure to respond
to this issue does constitute a crime under SB 1386 (California's data
protection law).

SEC. 2.  Section 1798.29 is added to the Civil Code, to read:
   1798.29.  (a) Any agency that owns or licenses computerized data
that includes personal information shall disclose any breach of the
security of the system following discovery or notification of the
breach in the security of the data to any resident of California
whose unencrypted personal information was, or is reasonably believed
to have been, acquired by an unauthorized person. The disclosure
shall be made in the most expedient time possible and without
unreasonable delay, consistent with the legitimate needs of law
enforcement, as provided in subdivision (c), or any measures
necessary to determine the scope of the breach and restore the
reasonable integrity of the data system.


---
Bob Woods
IT Security Administrator
Atlantis Casino Resort Spa * Reno
bwoods () atlantiscasino com
(775) 825-4700 x3549

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Prodigi Child
Sent: Thursday, October 16, 2008 12:58 PM
To: jason_jones98 () hotmail com; pen-test () securityfocus com
Subject: RE: reporting a web site breach

If the company refuses to do anything about it, and it is based in the
US,
try the FTC. If it is a bank, try the FDIC. Try to find an organization
to
which they must answer. If you have ABSOLUTELY NO other recourse, then I
think you should act on the fact that the bad guys likely already know
about
the security hole, and as a last resort consider calling a journalist.
Nothing like bad publicity to enact change in an organization :)

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On
Behalf Of jason_jones98 () hotmail com
Sent: Thursday, October 16, 2008 7:01 AM
To: pen-test () securityfocus com
Subject: reporting a web site breach

Hi Guys.

I need some advise. I was using a web site to book a service (details
witheld) and found that i could very easily browse thousands of customer
details i.e. name, address, phone numbers, the credit card details are
masked but just viewed source and the credit card details are cleartext
along with valid from, expire and cvv number. I called the company last
night to advise that they probably want to bring down their site and
advise
customers that their details have been potentially breached, basically
they
told me it would cost them too much money to go offline and that was
that! I
then attempted to call visa, mastercard and the high tech crime unit and
none of them seem to have a process to report this type of event unless
an
actual crime has taken place. So for my sanity could someone advise me
on
the ethical steps i should take to try and protect those customers?

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


<a href="http://www.atlantiscasino.com/emailfooter/index.asp";><img 
src="http://www.atlantiscasino.com/emailfooter/images/eml-footer-banner.jpg"; alt="Atlantis Casino Resort Spa - Every 
Player's Paradise" border="0" /></a>

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------