http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9074339
By Jaikumar Vijayan
April 2, 2008
Computerworld
In a security breach that sounds similar to the one disclosed by
Hannaford Bros. Co. last month, the Okemo Mountain Resort ski area in
Vermont announced this week that data from more than 46,000 credit and
debit card transactions may have been compromised during a system
intrusion over a 16-day period in February.
Okemo said in a security advisory released on Monday that the breach may
have affected customers who used their payment cards at the resort in
Ludlow, Vt., between Feb. 7 and Feb. 22, the time frame when the
intrusion took place. The intruder or intruders may also have accessed
data from card transactions processed between January and March 2006,
according to the advisory.
Bonnie MacPherson, a spokeswoman for Okemo, said today that at least
some of the data appears to have been stolen as the recent payment card
transactions were being authorized. "We can tell you that this was a
real-time theft," McPherson said. "The information was being taken as
the cards were being swiped."
If that is actually the case, it could make the breach at Okemo a close
cousin to the much larger one announced by Hannaford on March 17. In the
Hannaford breach, malware installed on servers in each of the
Scarborough, Maine-based company's grocery stores intercepted card data
as the information was being transmitted from point-of-sale systems to
authorize transactions.
Hannaford said in a letter sent to Massachusetts officials last week
that up to 4.2 million credit and debit card numbers, as well as the
expiration dates of the affected cards, were stolen by the malware
program and then sent in batches to a server hosted by a foreign ISP.
The grocer added that the discovery of the mass malware installation
prompted a wholesale replacement of its store servers, plus other
unspecified steps aimed at ensuring "that no versions of the malware
remain anywhere on the company's systems."
And Hannaford and Okemo may not be the only businesses disclosing
breaches involving payment card data in transit between systems.
According to McPherson, law enforcement authorities who are
investigating the breach at Okemo told resort officials that they
currently are looking into about 50 reported incidents of the same sort
in the Northeast alone.
McPherson said the system intrusion was discovered in late February but
declined to comment on how the resort learned of it, citing the ongoing
investigation. She added that Okemo has taken steps to close the breach
and prevent further intrusions, but again didn't disclose any specific
details.
In addition to notifying law enforcement officials, Okemo has informed
Visa, MasterCard and American Express of the breach. But the resort
doesn't have sufficient information on hand in its systems to directly
contact all of the individuals who might have been affected, McPherson
said. Resort officials have been told, she said, that customers will be
contacted directly by the banks that issued their credit and debit
cards.
Okemo doesn't know for sure how many cardholders were affected. But in
its advisory, the resort said that data from up to 28,168 card
transactions processed in February may have been compromised. Okemo
noted that the number of customers potentially affected may be smaller
than that number because some cards might have been used for multiple
transactions. In addition, data on 18,401 individual credit cards used
at Okemo from in early 2006 may have been accessed during the intrusion,
the resort said.
According to Okemo, a computer forensics review by an outside security
consultant found no evidence of any security breaches on the systems at
the Mount Sunapee ski area in Vermont or the Crested Butte Mountain
Resort in Colorado. All three ski areas are owned by the same company.
After Hannaford disclosed its breach, some analysts said it was the
first time that attackers had swiped payment card data while the
information was in transit on such a large scale. Most of the card data
compromises reported thus far have involved information stored in
databases on systems or in storage devices. But with companies putting
more effective controls around stored data, attackers may be shifting
their attention to data in transit.
___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
Comments