DVD Pacific hacked + fraud

Bassline

just thought i'd post this as a warning to any of you who have DVD pacific accounts that may have purchased anything lately.

Apparently they where hacked and sent out some users this email

Code:

Dear DELETED,

Our web site has recently been subjected to various hacking attempts. We upgraded our security measures in lieu of this to ensure the personal information we hold for you is fully protected. Part of these security enhancements have provided us information that led us to believe that some data had been compromised by way of a worm on the server. No anti virus or spyware was able to detect this but we now have information that contact had been made with an IP address outside our network. We attempted to capture this information without it leaving the server so as to determine exactly what was being transmitted. Unfortunately this worm had some type of self detection available and as soon as it realized we had discovered it, it self destructed leaving no trace evidence.

Yesterday the IP addresses we suspected behind this launched a malicious code attack on our SQL server and this allowed us to track their IP addresses to their source and we have identified ISP?s in Russia and the Ukraine. We have contacted the FBI, Secret Service and filed a full report at http://www.us-cert.gov. Further a report has been filed with FSB.ru.
We have blocked any possibility of this type of attack being successful but as a precaution we have auto updated all member account access passwords and now sending you your new temporary password as indicated below.

Your Login - DELETED
New Password ? DELETED

We would also request that you pay particular attention to your credit card statement to ensure that your not subject to any fraudulent transactions and if so notify your credit card issuer immediately. We will be providing a list of all cards we have on file to each of the credit card issuers so as they can also monitor any suspicious activity.

We will continue to monitor this situation closely as we have been since it arose and you can be assured our efforts to provide you with the safest shopping environment online will always be of the highest priority.

If you have any questions in relation to this issue please direct them to webmaster@dvdpacific.com

Regards,
DVD Pacific Inc.
Customer Information Support
http://www.dvdpacific.com
http://www.cdpacific.com
http://www.adultdvdpacific.com

i NEVER received this email,had i received it i would have cancelled my c/c details immediately BUT without this knowledge i receive my latest c/c bill only to find an online sale from some company called wbsales.com for $500 (?280) who i had never heard of so i phone up my c/c company up only to find out it was fraudulent and my c/c company tells me it came about from DVD pacific's website being hacked....dvd pacific hacked i say?...surely they would have let me know had that happened?.....apparently not :wacky:

so now i have had to cancel my c/c and get a new one sent out to me but in the meantime i'm stuck without it,thankfully my bank had refunded the funds to my account with no fuss but it still pisses me off that dvd pacific had this problem and completely ignored the issue and in some cases DENIED it happened and never informed EVERYONE about it :matrix:

Obviously i sent dvd pacific a nice email regarding there complete FUCK UP and total disregard of customers confidential details and request they inform me of the precautions of what they are doing to prevent them fucking up again :mrgreen:

anyone else had similar instances or actually receive an email about this?

PC_Arcade · **Posted:** Thu Oct 07, 2004 8:47 pm **Post subject:**

http://forum.dead-donkey.com/viewtopic. ... 5515#55515

Bassline · **Posted:** Thu Oct 07, 2004 8:49 pm **Post subject:**

now you tell me :lol:

PC_Arcade · **Posted:** Thu Oct 07, 2004 8:51 pm **Post subject:**

nope, THEN I told you :lol:

Bassline · **Posted:** Thu Oct 07, 2004 8:54 pm **Post subject:**

you expect me to read every damn thread here :-o next time you find out about fraudulent goings on please make it in BOLD and preferrably LARGE bright red text :mrgreen:

PC_Arcade · **Posted:** Thu Oct 07, 2004 9:14 pm **Post subject:**

Okey-Doke Skip

spudthedestroyer · **Posted:** Thu Oct 07, 2004 9:28 pm **Post subject:**

This is a violation of the data protection act, if they were a uk company they'd be in deep trouble, unfortunately I'm unsure what the US version of this law entails. Could be grounds for prosecution, certainly needs looking at by the ecommerce watchdog (anyone got the contact info?)

That response is totally half-assed anyway:

Quote:

No anti virus or spyware was able to detect this but we now have information that contact had been made with an IP address outside our network. We attempted to capture this information without it leaving the server so as to determine exactly what was being transmitted. Unfortunately this worm had some type of self detection available and as soon as it realized we had discovered it, it self destructed leaving no trace evidence.

That sounds like utter bullshit to be honest. Maybe they've purposely dumbed it down for customers but this is totally insignificant. A core requirement of the data protection act is to provide suitable levels of security.

Bassline · **Posted:** Thu Oct 07, 2004 9:32 pm **Post subject:**

wanna be my lawyer spud? :lol:

lets see if we can get some freebies as compo

spudthedestroyer · **Posted:** Thu Oct 07, 2004 9:58 pm **Post subject:**

The beauty is, if they do have a form of data protection act, then its a criminal matter, prosecution will be done by the state

Bassline · **Posted:** Thu Oct 07, 2004 10:25 pm **Post subject:**

this is in there t&c's

Code:

LIMITATION OF LIABILITY
UNDER NO CIRCUMSTANCES, SHALL DVD Pacific OR ANY OF ITS EMPLOYEES, DIRECTORS, OFFICERS, AGENTS, VENDORS OR SUPPLIERS BE LIABLE FOR ANY DIRECT OR INDIRECT LOSSES OR DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE USE OF OR INABILITY TO USE THE DVD Pacific WEB SITE.

THIS IS A COMPREHENSIVE LIMITATION OF LIABILITY THAT APPLIES TO ALL LOSSES AND DAMAGES OF ANY KIND (WHETHER GENERAL, SPECIAL, CONSEQUENTIAL, INCIDENTAL, EXEMPLARY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, LOSS OF DATA, INCOME OR PROFITS), WHETHER IN CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, EVEN IF AN AUTHORIZED REPRESENTATIVE DVD Pacific HAS BEEN ADVISED OF OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES.

IF YOU ARE DISSATISFIED WITH THIS WEB SITE OR ANY CONTENT ON THE SITE, OR WITH THE DVD Pacific TERMS AND CONDITIONS, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USING THE DVD Pacific WEB SITE. YOU ACKNOWLEDGE, BY YOUR USE OF THE DVD Pacific WEB SITE, THAT YOUR USE OF THE SITE IS AT YOUR SOLE RISK.

APPLICABLE LAW MAY NOT ALLOW THE LIMITATION OF LIABILITY SET FORTH ABOVE, SO THIS LIMITATION OF LIABILITY MAY NOT APPLY TO YOU. IF ANY PART OF THIS LIMITATION ON LIABILITY IS FOUND TO BE INVALID OR UNENFORCEABLE FOR ANY REASON, THEN THE AGGREGATE LIABILITY OF DVD Pacific UNDER SUCH CIRCUMSTANCES FOR LIABILITIES THAT OTHERWISE WOULD HAVE BEEN LIMITED SHALL NOT EXCEED ONE HUNDRED DOLLARS ($100). 

spudthedestroyer · **Posted:** Fri Oct 08, 2004 12:13 am **Post subject:**

These are not valid claims under this circumstance and the guidelines set out under the data protection act, you MUST comply with the rules regarding the safe storage of information on computerised systems if the government of your business location has signed legislation preventing foul play. They can not shift blame to the customer, if the fault is theirs. Those terms and conditions refer to ambiguous data loss, ie. server crash, trojan on your end, network scanning, etc. These are strict governmental regulations that all companies that store information on you must follow. These are not optional in the uk when sensitive information is stored, so if any company claims its not their fault when something happens without you doing anything, they aren't following the data protection act. Currently, the data protection act is signed by most of europe in varying forms, I have no idea if this applies to the US, but given its prominent position in ecommerce and business, then its an almost certainty. If they do not follow the criminal legislation passed by their government, then they are liable to criminal prosecution (ranging from fines to jail time based on severity). Note criminal, its not a civil matter.

Hypothetically, if I set up a company for online sales, and through incompetance or mismanagement (accident, or unavoidable security breaches don't count) allowed sensitive data to be stolen/given out, then I would be in violation of the data protection act. Bunging some half-assed disclaimer that's been copy and pasted from another site doesn't change the breach in criminal law. I would stress that this is only if it comes about from incompetance, or severe failure to keep up with security measures, or of course mismanagement.

As I said, I don't know if the us has any equivalent laws (any civilised country damn well ought to!), but you should report them to the international ecommerce organisation (i forget their name, but they manage fair and secure ecommerce and attack fraudulant or naff companies) and/or relevant data protection organisations if you suspect that they haven't done enough to protect your data.

However, those terms and conditions refer to loss of data such as you having a trojan or somethings not secure that's not their responsability. The problem here is that their security was insufficient to prevent a breach, this was not something that you were directly involved in. The failure is theirs. They did not secure your data, they did not ensure correct security measures were implemented and failed to respond and stop further damage.

It all boils down to if you think it was unavoidable, or if you think there's serious foul play. If its the latter, then reporting them is the relevant action to take.

Bassline · **Posted:** Fri Oct 08, 2004 12:26 am **Post subject:**

i'll wait and see what kind of reply (if any) i get to my snotty email i sent em as to what i do next but my guess is they'll just fob me off with some bollocks and make some vain attempt at an apology and that'll be that :roll:

i had a look around some e commerce data protection site and spotted the Euro countries that have all got the laws in check but found no info regarding the US...maybe they have no idea/care about that kinda thing?

but i am in two minds as to whether to use them again if they hold c/c numbers like they do which is a bit of a shitter as up until now the website has been pretty darn good for service and price

spudthedestroyer · **Posted:** Fri Oct 08, 2004 6:35 pm **Post subject:**

I have never and would never use them, shabby website design = shabby company.

Not including me of course... I'm allowed shabby web design cos I'm lazy as hell :lol:

Bassline · **Posted:** Fri Oct 08, 2004 7:34 pm **Post subject:**

at least the sci-fi forum looks nice even if there's no bugger posting there besides the main 10 users :wacky:

ViSCeRaL · **Posted:** Sat Oct 09, 2004 4:04 pm **Post subject:**

spudthedestroyer wrote:

I have never and would never use them, shabby website design = shabby company.

Not true I'm afraid, they are extremely good and their customer service is second to none IMO.

At least they actually put their hands up and admitted there was a breach of security. My credit card details have been with them before the breach and I have never had any hassle. If I did, I'd just get my CC company to charge it back anyway so I don't see what the fuss is about. I will continue to use them as I always have.

Bassline · **Posted:** Mon Oct 11, 2004 6:49 pm **Post subject:**

got my e-mail from them today

Quote:

Hi (name changed to protect the innocent

),

Terribly sorry to know that you have become a victim also of these fraudulent charges. The fraudulent charges emanating from the breach at our site seem to be connected to 3 companies and they are, Lip Inc., Diage.com and wbsale.com but we are not discounting any others at this time either. Understand completely how stressing and unsettling this can be and we sincerely apologize that you have had to endure this. We were aware of this on Tuesday 17th August at 2:00 am and sent out the e-mail advisory on Tuesday afternoon to all customers so there was no delay but must surmise that any data held by us before that time is subject to being compromised. Any information entered after this time we can assure you is completely safe. Your e-mail was sent to neveryoumind@home.com

and as your account password has been changed since the auto updating on 8/17 I can only assume that it was received ok by you. If your credit card issuer requires any further information at all please have them contact me directly and I will be glad to assist but if you have informed them the charge is fraudulent and card cancelled it should be reversed for you quickly.

It is now apparent that many sites were breached by the same or similar method during July and into August and we have provided a full log history of the event to the FBI who will continue investigations. Information from one card issuer indicates that they know who is responsible and as was our thoughts from our own investigation it has originated from Russia.

You can be assured that now we are aware of the means this has been perpetrated we put in place enhanced security measures to ensure that we can never again be subjected to same or similar threats.

We are Security Metrics site certified, we are Visa U.S.A. CISP Compliant, MasterCard SDP Compliant, American Express Compliant and Discover Card Compliant so the security in place does meet the very exacting standards required by these card issuers and unfortunately this attack was by a previously unknown or undocumented threat. It certainly has made us more vigilant and we will do our utmost to protect the information you provide us.

Regards,

Brad S.

apart from i never did get that email he says i should have received, i got an email stating i had requested password info (which i hadn't) but nothing that went on regarding fraud or there hacked site and to maybe keep an eye on my c/c bill...so what can you do eh? :wacky:

i also got my c/c bill today which actually had another fraudulent transaction for a similar amount (?287)...but i can't pay any of my bill since my card is now in pieces and i'm awaiting my c/c company to get my new one to me minus these fraudulent transactions :roll:

DVD Pacific hacked + fraud

Who is online