Millions of Records Leaked From Huge US Corporate Database (zdnet.com) 66
Millions of records from a commercial corporate database have been leaked. ZDNet reports: The database, about 52 gigabytes in size, contains just under 33.7 million unique email addresses and other contact information from employees of thousands of companies, representing a large portion of the US corporate population. Dun & Bradstreet, a business services giant, confirmed that it owns the database, which it acquired as part of a 2015 deal to buy NetProspex for $125 million. The purchased database contains dozens of fields, some including personal information such as names, job titles and functions, work email addresses, and phone numbers. Other information includes more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms.
Re: Don't worry (Score:1)
.. be happy
Leaked? (Score:2)
Is that the new synonym for Stolen?
fast solution (Score:5, Insightful)
But I guess that would be a burdensome regulation under our new regime.
Re:fast solution (Score:5, Insightful)
Re: (Score:2)
It's actually quite simple: just avoid storing all of this sort of data to begin with!"
So it's just Dun & Bradstreet's well-known dedication to establishing the dictatorship of the proletariat that caused them to accumulate all these data? Not, y'know, the fact that it's how they make money? This seems eminently plausible...
Re: (Score:2, Insightful)
It's actually quite simple: just avoid storing all of this sort of data to begin with!
Gawd what a stupid suggestion.
It costs money to store this shit (even insecurely). So why do companies do it? Because they believe that the value of the data outweighs the cost of storing it.
So your idiot "just don't do that" suggestion is basically asking companies to walk away from money because. . .why? Why would they do that?
Would criminalizing the storage of certain data be "non-leftist"?
Re: (Score:3)
Spoken like a person who doesn't know what Dunn and Bradstreet do. One of their functions is to store this type of data as well as corporate payment records so businesses can lookup a credit score on other businesses. This let's them do things like setup charge accounts quickly.
It has all the flaws of credit reporting agencies plus their strengths. Speed of modern business that the time wasted filling out a credit report, sending it in, hoping to get responses takes too long.
Also businesses still use c
I'd say it's the #1 most effective (and cost effec (Score:3)
> > avoid storing all of this sort of data to begin with!
> Gawd what a stupid suggestion.
Based on my 20 years in information security, I'd say that's the very BEST suggestion to start with. Not only is it very effective, it's very COST EFFECTIVE. Twenty years ago, a great many companies used social security number as a handy identifier for people. Now we don't do that so much - there is no need to use SSN as a customer ID or employee ID, and there is great risk in doing that. So just don't stor
If it can be charged, it's probably sensitive (Score:3)
If the "tokenized forms of the CC number" can be used to charge the card, it probably shouldn't be made public.
If many customers will legitimately want to do further purchases, and for some reason entering the CC number is a major hurdle (both propositions that should be proved, not assumed) you can actually store it without storing it, in a way.
Certain customers can make purchases from us without re-entering their CC, but the CC number isn't stored on the web server, nor in the database that drives the web
Re: (Score:2)
While minimizing the footprint for attack is the best way to handle the data, it is still at risk from internal threats. The isolated system still has a management interface, and people who develop/maintain it. Not to mention with "cloud" services being all the rage today, it's probably hosted on a VPS that god knows who owns the hardware. Nothing stops the provider from getting hacked, and then the whole VPS getting copied out.
There is no way to fully secure shared data. You can only mitigate as much r
On-premises, armed guards (Score:2)
> There is no way to fully secure shared data. You can only mitigate as much risk as possible.
This is true. In our case, it's not in the cloud. It's a physical machine. An old machine worth about $30 because all it needs to do is store the encrypted data and when needed send it to the credit card network.
Orginally access was via the console only, you had to physically touch the keyboard to do anything on the system, with all ports blocked on the firewall. Later we enabled only ssh from the internal net
Re: (Score:2)
Re: (Score:1)
Wrong, snarkleface.
Like Trump, you offer yak-yak like
It's actually quite simple: just avoid storing all of this sort of data to begin with!
but you don't submit an alternative solution .
You are dismissed.
It's already more costly than that. Risk (insuranc (Score:4, Informative)
> $1 penalty per leaked / stolen record
The average cost to a company that's breached is already well over $1 per record, so no that doesn't "quickly remedy this problem". It IS slowly getting things fixed. A lot of companies have a Chief Security Officer now, a C-suite executive responsible for security. That wasn't the case ten years ago.
The issue is, the likelihood of a major breach is low (for each conpany). People, including executives, aren't good at reasoning about unlikely events. On the other hand, insurance companies are very good at it. Risk assessment and risk reduction is their business and they've gotten quite good at it. Insurance companies created the fire code, UL labs, etc to reduce the risk of fire. They hold companies responsible for properly mitigating all kinds of risks, as a condition of issuing insurance. The cost of the insurance, which shows up on the balance sheet, is based on the risk-reduction methods that the insured uses. (Just like installing monitored fire and burglary alarms reduces the cost of your homeowners insurance). I think we'll see a major shift in information security when the insurance companies get more involved, requiring companies they insure to follow certain standards.
Re: (Score:2)
This. 100% this. It encourages a "store less, protect more" ethos. So if you're a company that really wants to make storing/selling demographic data your business model (ie marketing / telephone sanitizers), you'll protect the hell out of that database. It also discourages fly-by-night companies with no security-dna to start that type of business.
I would add levels of pain. Name and address? That's mostly publicly available; small fine. SSN, CCN, pins or passwords? You had better have a good reason for stor
Re: (Score:2)
Companies spend some dollars on security to comply with audits and 1) know they are going to get owned (due to having their data managed on servers all over planet earth) 2) know they have a risk rider on their insurance. If the government wants to get in their face, they can just point to the CIA Vault#7 leak and if they haven't heard about that, they can point to the DNC email server.
Security is officially and illusion. Even the high-end "super secure" stuff is owned by the CIA, so what are you going to
Re: (Score:2)
So any penalty imposed on them would just end up being paid for by the government via higher fees, and/or higher contract bid prices.
Re: (Score:2)
$1 penalty per leaked / stolen record, imposed by the FTC/SEC/SSA/CFPB will quickly remedy this problem. As long as the value of private personal information is intangible, the value it will be assigned in companies' risk assessments and capital plans is $0.
I wish that penalties like this would spur them to keep my data safe, but it won't. At best it *might* make them try a little harder but I'm afraid the fact is that nothing will keep our data safe from those who want it.
The CIA, NSA, FBI....they all get hacked. Everyone gets hacked. There's no preventing it as far as I can tell. The attack surface is so large and there are so many potential points and methods of entry, it's a losing battle. That doesn't mean you should take precautions but if "they" want yo
Re: (Score:2)
Fuck. TypoMan strikes again.
"That doesn't mean you shouldn't take precautions..."
Fiancial impact on the business world (Score:2)
Re: (Score:2)
well, since my e-mail was in the db (https://haveibeenpwned.com/) I would love a copy of it...
Anyone have a link to it?
A word (Score:2)
"...more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms."
The word you're looking for is 'client list' . (damn, that's 2 words)
Don't worry! (Score:2)
As long as giant databases remain in respectable hands, no harm can come of them; so just worry about whether it was a nation-state actor or an 'advanced persistent threat'. Nothing else to see here.
Mostly fake? (Score:1)
I did a haveibeenpwned check against our domain name and a couple of fake email addresses showed up in the NetProspex leak. These were email addresses that have never existed. Plus, none of our actual email addresses were in the leak.
This may be a list of 33.7 million mostly fake or SPAM email addresses. Just sayin'.
Lol, say what? (Score:3)
From http://www.dnb.com/utility-pag... [dnb.com]
"Data Security: Dun & Bradstreet applies appropriate technical, physical, and administrative Data security measures to protect Data against unauthorized access and disclosure."
Except when they don't....
Also, (farther down the page): "Dun & Bradstreet does not respond to Do Not Track Signals."
Re: (Score:2)
Unauthorized here means unauthorized by them. They couldn't care less what you authorize.
Credit stuff is one thing, federated ID is next (Score:4, Informative)
If I were a thief, the thing I'd try attacking is the increasing use of federated identity, and hit those targets with everything I had...social engineering, zero-days, finding soft spots where cut-rate consulting firms left the door open, the works. In the new cloudy world of abstracted everything, companies are finding it easier to rely on a few identity providers..."log in using Facebook" and the like. In the Microsoft, Google and Amazon iterations of this (MS account, Azure AD, Google Account, Amazon Identity Management,) companies are using third parties to handle authentication to their resources (at least on the web.) This means that the identities are slowly being consolidated to a few providers on the corporate side. Anyone using Office 365 in an organization likely has their credentials synchronized up to Azure AD, for example, so they can use the web apps like Outlook and Skype.
OAuth and the like set up a very strong environment, but it's still just an identity database under the hood. Even if the provider has no idea what your password is, a hash of it is being stored somewhere...otherwise you wouldn't be able to authenticate. If anyone ever comes up with an easy way to break this, then everyone's going to be in for a round of password changes and free credit monitoring. Getting someone's corporate credentials gives thieves a lot more access than stealing one database.
Re: (Score:2)
If anyone ever comes up with an easy way to break this, then everyone's going to be in for a round of password changes and free credit monitoring.
You mean like the Ashley Madison hack [schneier.com], where the hackers found a weakness in the implementation of bcrypt, and were able to compute user passwords in "Hollywood time"?
The bottom line there is that, like encryption, non-experts shouldn't develop their own implementations of a password hash. (Similar to "non-experts shouldn't implement encryption").
With a good imple
Alright, where do I get it? (Score:2)
It can't be copyrighted, and it is not (any longer) private information either... Is there a torrent or something?
Re: (Score:2)
been looking around, Not a single source in the wild yet
Re: (Score:2)
One record at a time!
At least it wasn't the government (Score:2)
Oh noes! (Score:2)
The purchased database contains dozens of fields, some including personal information such as names, job titles and functions, work email addresses, and phone numbers. Other information includes more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms.
So... pretty much the exact same information you can get by viewing someone's LinkedIn profile?