Unencrypted Lost Tape Affects 230 Retailers

Lucas123 tells us that a backup tape lost by Iron Mountain reportedly contains credit card information from 650,000 customers. The unencrypted tape also holds Social Security numbers for 150,000 customers. Quoting the Computerworld Article: "Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. 'Clearly that number includes many of the national retail organizations,' he said."

Broken system

[a_nonamiss]

Honestly, how long until someone realizes the current system is broken? We can't hope to keep our Social Security numbers secret indefinitely. We have everything in your life tied to this one, unchangeable number. The credit system needs to be overhauled so that it doesn't matter if you have my name, address, SS# and mother's maiden name. Just off the top of my head, how about a challenge-response system. In a secure manner, I set a secret password. For more security, you could even set single-use passwords. When I go out to get credit, I tell someone on the phone my password. Someone else goes out and tries to get credit without my password and they get arrested. It's not perfect, but a hell of a lot better than what we have now. And it took me 5 minutes to think that up. I bet someone with 6 weeks and half a million dollars could come up with an even better way.

Re:Keyword: Unencrypted

[IBBoard]

The problem with encryption is that the news agencies still don't report it to make people feel that bit safer.

When one of our high-street banks in the UK lost details of quite a large number of customers' details then none of the major news agencies I saw reported that it was encrypted. It was all "bank loses details", "customers at risk", "think of the bank details (and children)!". It took a bit of digging to find out that company policy was that hard disks were encrypted and that this one apparently was as well.

Re:Unencrypted?

[Pig Hogger]

If companies want to store customers credit card numbers and social security numbers for years on their systems, could they at least use common sense?

Common sense is in notorious short supply the further you go up the management chain. Nowadays, companies are run by types with a sheet of paper stamped with the magic letters "MBA", which means that the bearer has been infused with knowledge that is supposed to increase profits.

MBAs are taught first and foremost to ditch "common sense" because their acute knowledge is supposedly vastly "superior" to common knowledge.

Re:Keyword: Unencrypted

[mattwarden]

There answer is: it's not hard at all. If we can assume GE Money is using Oracle, it has had TDE (transparent data encryption) since 10g. All they have to do is alter a column, setting the 'encrypt' option, and suddenly its contents are stored on disk as encrypted. No application changes are required*, because Oracle unencrypts the data transparently as it is read from disk.

In this case, the stolen tape would include lots of plaintext data, but the sensitive data would be unintelligible. The only way to read the sensitive data is to retrieve the backup of the Oracle wallet also.

* as long as the encrypted columns do not require a range scan of an index (which obviously wouldn't work), but when are you range-scanning a credit card number or SSN?

Re:Broken system

[mattwarden]

Absolutely. And we've had this ability since the 70s (Diffie-Hellman, anyone?).

Re:Broken system

[mollymoo]

You tell someone on the phone your password. That person now knows your password.

The solution to that, which is implemented by more than one company I deal with, is to only validate a randomly selected subset of the password. "Can you confirm the third and fifth letters of your password please Sir." The person in the call centre doesn't know your entire password and an eavesdropper would need to listen to several calls to get the entire password. It's not perfect, but it requires no physical device (which anything good enough to satisfy a cryptographer surely would) and regular people can generally manage to do it just fine.