Mr Sm1th

Human error continues to be responsible for large disclosures of sensitive information

Recently I had to contact a mail order pharmacy to inform them that the envelopes they used for their statements were insufficient for preventing anyone from seeing the SSN, which was printed on the first page of the statement. You didn't even have to hold it up to the light it was so obvious. They told me that apparently "someone" changed the layout of the form but neglected to change the envelope to mask the new layout of the sensitive information. An obvious lack of communication or simply negligence. I questioned why they even printed the whole SSN on the statement in the first place.

Many examples of disclosure of sensitive information caused by human error can be found in the Privacy Rights Breach Database. The most recent is another that was completely avoidable (see below). People, if you don't want your company to be added to this Breach Database then please manage your technology and appropriately oversee the dissemination of EVERYTHING THAT LEAVES YOUR COMPANY. Especially large mailings like this.

"Universal American Action Network of St. Petersburg, FL - Thousands of Pennsylvanians could become victims of identity theft just because a piece of mail has been sent to their homes. Right on the front of the piece of mail, under the persons name, in plain view, is the recipient's Social Security number. The postcards were from the Universal American Action Network, a subsidiary of Universal American Insurance. 80,000 postcards with Social Security numbers on them were sent out to Universal clients throughout the country. More than 10,000 of them were mailed to Medicare participants in Pennsylvania."
[Source: privacyrights.org Data Breach Database]

Posted via email from Kenneth M. Smith CISSP CISA GCIH FREAK

Is this what #PCI has come down to?

Spotted this yesterday and it made me laugh. Think a plunger would help with PCI DSS?

Posted via email from Kenneth M. Smith CISSP CISA GCIH FREAK

Marriott Rewards email snafu, customers get test email in error

If you are a Marriott Rewards member you may have received an email from them recently that didn't quite make sense. I got one, it looked something like this:

--------------------------------------------------------------------------------

Subject: "Don’t miss your free night from Marriott Rewards"

Attributes
FIRST_NAME : YOUR_NAME_HERE

CUSTOMER_KEY : ######## (8 digit number that I have removed)

MR_NUMBER : ######### (9 digit number that I have removed)

MR_NUMBER_ENCRYPTED : (32 character value here also removed)

TEST Links

Hosted Email Link Using MR_NUMBER : With MR_NUMBER Link

Hosted Email Link with out MR_NUMBER : Without MR_NUMBER Link

Hosted Email Link with out Jennies Suggestion : With entrypted MR Number & Customer key

--------------------------------------------------------------------------------

I inquired with Marriott about this and it was apparently an error. Looks like they were testing some functionality but emails got sent to actual customers. Here is their response email.

--------------------------------------------------------------------------------

"Dear Valued Guest,

Yesterday morning, you received an email from Marriott in error. We were testing functionality to further enhance your online experience. During the testing process, a small number of emails erroneously deployed.

In the email, you may have noticed your name and a reference to your MR number. Rest assured, the information contained therein is private and no information specific to you or your account was shared with anyone else. To reiterate, this email was sent to you in error, but the contents of the message itself pertain only to you and your account.

Marriott is committed to your data security and the protection of your personal information. We apologize for any confusion our earlier email may have caused.

Best regards,
The Marriott Team"

--------------------------------------------------------------------------------

What it doesn't say is whether this information in the email was "sensitive". Why would there be a field MR_NUMBER_ENCRYPTED? I followed a few of the URL's in the email and information similar to the email content was there on an unprotected web page. Hmmm.

Kenneth M. Smith CISSP CISA GCIH

Information Protection, Privacy, PCI Consulting

Phone: 978-595-1536 (1KEN)

www.Exultium.com

LinkedIn: http://www.linkedin.com/in/1ksmith

Blog: http://post.ksm1th.com

Twitter: @ken5m1th

Posted via email from Kenneth M. Smith CISSP CISA GCIH FREAK

Retail sales associates sentenced for role in credit card, bank fraud

Four men from Atlanta Georgia were sentenced this week by United States District Judge Orinda D. Evans on charges of bank fraud, credit card fraud and aggravated identity theft.

http://www.databreaches.net/?p=7839

Posted via email from Kenneth M. Smith CISSP CISA GCIH FREAK

I'm getting more reports of card fraud (cloned cards) taking place in the South East

Maybe a month ago I wrote about reports of card fraud taking place in North Carolina. These were physical (card present) transactions in which other items of approximately $200 each were purchased. These are likely gift cards or some other form of anonymous payment card. This likely means that there was a stripe data breach and fake cards were made with the card stripe data.

I heard another report of this more recently, this time from a Discover Card customer. Same MO, and the fraudulent transaction took place at a Walmart store just like the others.

A stripe data breach that has yet to be disclosed perhaps?

Posted via email from Kenneth M. Smith CISSP CISA GCIH FREAK