Re: reporting a web site breach

["David Glosser" <david.glosser () gmail com>]

the company is not in PCI compliance if credit card numbers are in cleartext.
They are also prohibited from storing CVV numbers.

Tell them that they are not in PCI compliance and they can get fined
tens of thousands of dollars by not being in compliance.

Call Visa and MC back and tell them this site is not in compliance,
and tell them you know of a site which is not in compliance, and ask
them how to report non-compliance.

Let us know how you make out. Good luck.








On Thu, Oct 16, 2008 at 8:01 AM,  <jason_jones98 () hotmail com> wrote:
> Hi Guys.
>
> I need some advise. I was using a web site to book a service (details witheld) and found that i could very easily 
> browse thousands of customer details i.e. name, address, phone numbers, the credit card details are masked but just 
> viewed source and the credit card details are cleartext along with valid from, expire and cvv number. I called the 
> company last night to advise that they probably want to bring down their site and advise customers that their details 
> have been potentially breached, basically they told me it would cost them too much money to go offline and that was 
> that! I then attempted to call visa, mastercard and the high tech crime unit and none of them seem to have a process 
> to report this type of event unless an actual crime has taken place. So for my sanity could someone advise me on the 
> ethical steps i should take to try and protect those customers?
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Security Trends Report from Cenzic
> Stay Ahead of the Hacker Curve!
> Get the latest Q2 2008 Trends Report now
>
> www.cenzic.com/landing/trends-report
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------