Orbitz Says Legacy Travel Site Likely Hacked, Affecting 880,000 Credit Cards (usnews.com) 29
hyperclocker shares a report from U.S. News & World Report: Orbitz says a legacy travel booking platform may have been hacked, possibly exposing the personal information of people that made certain purchases between January 1, 2016 and December 22, 2017. Orbitz said Tuesday about 880,000 payment cards were impacted. Data that was likely exposed includes name, payment card information, date of birth, phone number, email address, physical and/or billing address and gender. The company said evidence suggests an attacker may have accessed information stored on the platform -- which was for both consumers and business partners -- between Oct. 1, 2017 and Dec. 22, 2017. "Orbitz said it worked with a forensic investigation firm, cybersecurity experts, and law enforcement once the breach was discovered in order to 'eliminate and prevent unauthorized access to the platform,'" reports The Verge. "The company also notes that its current site, Orbitz.com, wasn't affected. It is notifying customers who may have been impacted and is offering a year of free credit monitoring."
One year free credit monitoring (Score:5, Interesting)
Re: (Score:2)
To be fair though, credit cards themselves are a joke. Here is my 16 digit secret key. Please don't take more than you need.
Indeed. The root problem here is we base financial security on information that is both secret and widely known. Thousands of people have access to my SSN, and even more have access to my CC #s.
We should have 2FA for small transactions (debit cards already do this, as does ApplePay, Walmart-Pay, and WeChat), and 3FA for large transactions.
Re: (Score:2)
Chip & PIN, my friend. What you have (chip), what you know (PIN).
Widely used in the US, ubiquitous globally.
Re: (Score:2)
Even better. Visa 3D Secure, Amex Safekey, MasterCard Securecode.
And your card data doesn't go to the merchant.
Re: (Score:3)
One year credit monitoring is a joke. Seriously, in this day and age who still has not frozen there credit? Equifax now offers it for free after their breach and the other two (TransUnion and Experian) are just a few bucks. Depending on what state you live in you might even be able to freeze your credit for free depending on the law there.
Actually the storing of card information, especially in an unencrypted or easily decrypted format is the joke here. If sites didn't store card information then we wouldn't have so much need for credit monitoring or so many freezes.
Re: (Score:2)
True, this is possibly a PCI compliance violation. PAN should be encrypted sufficiently to defeat realistic threats. Preventing acquisition isn't the standard.
They got me - the dates match and it was Orbitz (Score:3)
Regulation - there should be more of it (Score:2)
Re:Regulation - there should be more of it (Score:4, Interesting)
But even then they shouldn't be storing that stuff by default, but rather because the customer flies that often and has insisted they keep it or has enrolled in some kind of subscription model (like Netflix).
This is partly because of the stupidity and apathy of the banks. Immediately after the first transaction, they could give the merchant (Orbitz in this case) a token for repeated transactions, that could only be used by that merchant. Then the merchant would only need the last 4 digits (to confirm the CC # with the customer), and would have no need to store the other digits.
People that suffer from CC fraud:
1. End users
2. Merchants
People that have the power to fix the problem:
1. Banks
Please note that these are disjoint sets. Banks actually profit from fraud because they can charge $30 for every chargeback, which costs them $0 to process. They have no incentive to fix the system.
Re: (Score:2)
But even then they shouldn't be storing that stuff by default, but rather because the customer flies that often and has insisted they keep it or has enrolled in some kind of subscription model (like Netflix).
This is partly because of the stupidity and apathy of the banks. Immediately after the first transaction, they could give the merchant (Orbitz in this case) a token for repeated transactions, that could only be used by that merchant. Then the merchant would only need the last 4 digits (to confirm the CC # with the customer), and would have no need to store the other digits.
People that suffer from CC fraud:
1. End users
2. Merchants
People that have the power to fix the problem:
1. Banks
You're correct up to here.
Please note that these are disjoint sets. Banks actually profit from fraud because they can charge $30 for every chargeback, which costs them $0 to process. They have no incentive to fix the system.
Banks actually lose money on fraud. You cant do a chargeback to a fake merchant set up in some shithole where criminals are pretty much permitted to get away with murder so long as they remain in a certain Vlad's favour. As soon as the first chargeback comes in, the merchant account is shuttered with the money already moved to other accounts and the start the whole thing over again with a new merchant account.
How banks make money is by skimming a few percent of every transaction
Re: (Score:2)
In every way banks lose due to fraud. Think of it this way:
Your card data is used to purchase $30 of goods. Fraud is reported:
- Bank pays merchant as fraud isn't yet reported.
- Call or web site reporting the fraud. This has a cost.
- Reimbursement or suspense of charge to card holder, net revenue is now negative, you cannot recover payment to merchant.
- If merchant complied with standards, reimbursement is complete, or the chargeback is reversed, more costs.
That $30 charge will require $1000 in charges to r
Worthless data (Score:3)
Data from 2015/2016? Essentially worthless by now as those same numbers have been leaked/stolen many times over at this point.
See? There's a benefit to rampant corporate insecurity!
Gum maker has a travel site? (Score:1)
But why?
What does "a legacy travel booking platform" mean? (Score:1)
I can't help feeling that Orbitz is being deliberately obscure.
Is this a platform under the orbitz.com domain? Was it under a different domain? And why "a legacy"? Have they had a multitude of booking platforms?
Re: (Score:2)
That's what I want to know. If it wasn't Orbitz.com, what was it? Was it the 'old' orbitz.com before they were bought by Expedia? When were they bought by Expedia? My wife said, "Why do they call it Legacy, is it for old people?"
I have a good idea .. (Score:2)
I have a good idea, why not store the customer data in an encrypted form on the booking platform. That way, in the event Orbiz gets hacked, no customer information.