3 ms·
Krebs has since updated his post with confirmation from three independent Ashley Madison users confirming their data was in the leak. It looks like this was th
by iaw 11y ago
Krebs has since updated his post with confirmation from three independent Ashley Madison users confirming their data was in the leak. It looks like this was the real deal.
- jpatokal 11y agoInterestingly, the three people say the last digits of their credit card numbers were included in the dump, while the Ashley Madison CTO says they don't keep credit card numbers, full stop.
- inversionOf 11y agoStoring the final digits complies with the CC requirements, to my knowledge. I mean, every online store happily shows me my final four digits. So it could just be confusion about what they mean. Having said that, Ashley Madison has approximately zero credibility, so whatever their agents say is open to intense skepticism.
- agopaul 11y agoThis, you don't even need to be PCI compliant to store the last 4 digits and the expiration date. This way you can show this info to the user and email the user before the card expires (in case of recurring payments). If you work with external payment gateways sometimes you are provided with this information even if the card processing is done directly on the processor page (you only have access to limited information about the card and the transaction)
- heimatau 11y agoYeah, I noticed they said that too. I look forward to hearing more about the hack. AM says it wouldn't be through them. Makes me wonder about where the hackers got in at.
- kzhahou 11y agoWhereupon we find out that a developer had indeed added CC to the database, and the CTO didn't know...? :-\