Security Breach Roundup: Anonymous Strikes Again

For our final security breach roundup of 2011 we’ve got two breaches involving charitable giving and another involving the credit card industry. We’ll wrap up with some numbers and highlights of the year’s biggest security breaches.

Robin Hood-like Hackers Breach Security Company Site

In an attack reminiscent of the breach of the security firm RSA earlier this year, the hacker group Anonymous is claiming responsibility for a breach of the website of Stratfor Global Intelligence, a company that provides strategic intelligence on global business, economic, security and geopolitical affairs. Their intent, according to a story in The New York Times, was to steal $1 million from

Stratfor clients and donate it to various charities. As the Times reported:

The hackers posted a list online that they say contains Stratfor’s confidential client list as well as credit card details, passwords and home addresses for some 4,000 Stratfor clients. The hackers also said they had details for more than 90,000 credit card accounts. Among the organizations listed as Stratfor clients: Bank of America, the Defense Department, Doctors Without Borders, Lockheed Martin, Los Alamos National Laboratory and the United Nations.

The group also posted five receipts online that it said were of donations made with pilfered credit card details. One receipt showed a $180 donation from a United States Homeland Security employee, Edmund H. Tupay, to the American Red Cross. Another showed a $200 donation to the Red Cross from Allen Barr, a recently retired employee from the Texas Department of Banking. Neither responded to requests for comment.

The hackers said on Twitter that the attack, which began on Dec. 24, would be the beginning of “a weeklong holiday hacking spree,” according to the TImes. The group also defaced the Stratfor web site, which as of Dec. 27 was still “undergoing maintenance.”

A Good News, Bad News Breach

In another breach involving charities, The Republic of Columbus, Indiana reports the Good News Garage in Burlington Vt., which helps low-income families find reliable transportation, suffered a breach. As The Republic reports:

Good News Garage is sending out thousands of letters this week warning that a thief broke into a car the day after Thanksgiving and stole a backpack containing a data tape with the names, addresses and in some cases the Social Security numbers of Good News Garage vehicle donors dating back 15 years.

That’s the bad news. But here’s the good news:

Investigators won’t say where the burglary occurred, but the information on the tape was encrypted.

Good News Director Michael Muzzy tells WPTZ-TV (http://bit.ly/uhmX92 ) none of the people on the list have reported any signs their identities were being used improperly.

Muzzy says security procedures have been changed since the burglary.

Moral of the story: if you insist on leaving valuable information in your car, at least make sure it’s encrypted.

Visa Europe Investigates Security Breach

No security breach roundup seems complete with a credit card company included. Visa Europe didn’t disappoint in December. From PCWorld:

Visa is investigating a potential security breach at an European payment processor that might have affected cardholders in eastern Europe.

“Visa Europe has been informed of a potential data security breach at a European processor and an investigation is underway,” the company said in a statement. “We are working closely with our member banks to ensure cardholders are protected,” it added … Multiple banks have been alerted and some have already taken steps to limit the potential fraud. Romanian state-owned CEC Bank is in the process of reissuing 17,000 payment cards as a result of the incident.

543 Million Records Breached Since 2005

Here are some truly frightening numbers to stew on as the year comes to a close, courtesy of Storage and Destruction Business magazine:

The Privacy Rights Clearinghouse, San Diego, has tracked 535 breaches involving 30.4 million sensitive records as of mid-December of 2011. This brings the total reported records breached in the United States since 2005 to 543 million, the organization says.

“This is a conservative number,” says Privacy Rights Clearinghouse Director Beth Givens. “We generally learn about breaches that garner media attention. Unfortunately, many do not. And, because many states do not require companies to report data breaches to a central clearinghouse, data breaches occur that we never hear about. Our chronology is only a sampling.”

The story also offers a list of the largest breaches in 2011, including this one from April:

Epsilon, an email service provider for companies, reported a breach that affected about 75 client companies. Email addresses and customer names were affected. Epsilon has not disclosed the names of the companies affected or the total number of names stolen. However, millions of customers received notices companies, making this the largest security breach ever. Conservative estimates place the number of customer email addresses breached at 50 to 60 million. The number of customer emails exposed may have reached 250 million.

We also reported on the Epsilon breach in a previous roundup.

CRN Reports on the Biggest Security Breaches of 2011

There’s no shortage of lists detailing the biggest breaches of 2011, including one from CRN. It includes more attacks by Anonymous, a breach exposing health care information on more than 2.7 million people, a virus exposing personal information for unemployed people in Mass., two attacks on gaming networks and two more related to the credit card industry. Let’s hope things are better in 2012.

Security Breach Roundup: Anonymous Strikes Again