5 ms·

The Travelex website said it was down due to "planned maintenance". Is that not an outright lie, since it was obviously down for other reasons? Is there anythin

The Travelex website said it was down due to "planned maintenance". Is that not an outright lie, since it was obviously down for other reasons? Is there anything preventing a company from lying about something like this?

stronglikedan 7y ago
No, and no, because they'd just say they started planning the maintenance as soon as they recognized the problem.
mattlondon 7y ago
In previous projects I have worked on many years ago, the "down for maintenance" page was the page that was automatically served by the reverse proxy whenever we took the backend app servers down for whatever reason (emergencies, planned releases etc) Granted this was years ago - I don't know what people do these days if all backend servers are unavailable. I guess the alternative to "planned maintenance" is the more-accurate message of "OMG - shit's on fire dude!" but that is not appropriate for corporate PR speak ;-) Sounds to me like someone probably got a "turn everything off while the police investigate - do not touch anything or we'll chop your fingers off/fire you" edict from management, so they wont even put up an unplanned-emergency message for fear of crossing-management/damaging evidence/screwing up while putting up a rushed message/letting hackers back in/etc
- dustinmoris 7y ago
  This would be ok for the first hour/day when this happenend, but after a whole week when it's been clear that extremely sensitive customer information has been breached then this is not an acceptable response and/or excuse. They should put up a responsible message and pro-actively notify customers too. I hope they will get the highest possible fine for GDPR violations. This is an appalling response and treatment of customer data.
kjaftaedi 7y ago
Travelex operates in Europe and is bound by GDPR regulations. Travelex should have notified their supervisory authority within 72 hours of the breach, and are also required to notify end users in a timely manner. https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ According to the article, end users still have not been notified. The lack of timely and proper notification as well as the misleading website information can be taken into account by the data protection authority in determining if the company should be fined, and the fines in question can be quite substantial.
- jiveturkey 7y ago
  > Travelex operates in Europe and is bound by GDPR regulations. To clarify, it's not that Travelex is located in or operates in Europe, it's that they hold data of EU residents. If they operated in Zimbabwe yet held data on EU residents, they would still be bound by GDPR.
  - deith 7y ago
    How could they enforce that? By barring EU residents from dealing with Travelex?
    - jiveturkey 7y ago
      Well Travelex is a gigantic company, well-run (business-wise if not infosec-wise :P) and would comply with any imposed fines etc. But your question is interesting. Imagine an onion service, theoretically perfectly shielded, that took Personal Data from it users and then sold it. Or even a normal Internet service, based in North Korea. GDPR would be unenforceable. Ultimately we depend on the norms of international agreements, the desire and need to interoperate with global banking systems, etc.
      - volkl48 7y ago
        As far as I can tell there's still no actual mechanism in existence to enforce GDPR against an entity which has no significant operations in/financial exposure to the EU. The GDPR text basically says "we'll ask other countries nicely and negotiate with them". I'll be interested to see how the first real case goes against even a US-based entity that doesn't operate in the EU, much less one based in a country like North Korea.
goldcd 7y ago
Could say they put the website into maintenance, when somebody had violated and disabled their back end. Website's "fine" - it's just waiting to be plugged into something that works.
mzs 7y ago
I don't believe that, from the journalist* "Travelex has not responded to our multiple requests for response to these allegations. Not answering calls/ texts voicemails for the last couple of hours." * https://twitter.com/joetidy/status/1214599174664138757 https://twitter.com/joetidy/status/1214599174664138757 edit: also they gave a different (spreading virus v. third party issue) statement here earlier: https://eandt.theiet.org/content/articles/2020/01/travelex-takes-its-services-offline-after-massive-cyber-attack/ https://eandt.theiet.org/content/articles/2020/01/travelex-t...

stronglikedan 7y ago

No, and no, because they'd just say they started planning the maintenance as soon as they recognized the problem.

mattlondon 7y ago

In previous projects I have worked on many years ago, the "down for maintenance" page was the page that was automatically served by the reverse proxy whenever we took the backend app servers down for whatever reason (emergencies, planned releases etc) Granted this was years ago - I don't know what people do these days if all backend servers are unavailable. I guess the alternative to "planned maintenance" is the more-accurate message of "OMG - shit's on fire dude!" but that is not appropriate for corporate PR speak ;-) Sounds to me like someone probably got a "turn everything off while the police investigate - do not touch anything or we'll chop your fingers off/fire you" edict from management, so they wont even put up an unplanned-emergency message for fear of crossing-management/damaging evidence/screwing up while putting up a rushed message/letting hackers back in/etc

dustinmoris 7y ago
This would be ok for the first hour/day when this happenend, but after a whole week when it's been clear that extremely sensitive customer information has been breached then this is not an acceptable response and/or excuse. They should put up a responsible message and pro-actively notify customers too. I hope they will get the highest possible fine for GDPR violations. This is an appalling response and treatment of customer data.

kjaftaedi 7y ago

Travelex operates in Europe and is bound by GDPR regulations. Travelex should have notified their supervisory authority within 72 hours of the breach, and are also required to notify end users in a timely manner. https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ According to the article, end users still have not been notified. The lack of timely and proper notification as well as the misleading website information can be taken into account by the data protection authority in determining if the company should be fined, and the fines in question can be quite substantial.

jiveturkey 7y ago
> Travelex operates in Europe and is bound by GDPR regulations. To clarify, it's not that Travelex is located in or operates in Europe, it's that they hold data of EU residents. If they operated in Zimbabwe yet held data on EU residents, they would still be bound by GDPR.
- deith 7y ago
  How could they enforce that? By barring EU residents from dealing with Travelex?
  - jiveturkey 7y ago
    Well Travelex is a gigantic company, well-run (business-wise if not infosec-wise :P) and would comply with any imposed fines etc. But your question is interesting. Imagine an onion service, theoretically perfectly shielded, that took Personal Data from it users and then sold it. Or even a normal Internet service, based in North Korea. GDPR would be unenforceable. Ultimately we depend on the norms of international agreements, the desire and need to interoperate with global banking systems, etc.
    - volkl48 7y ago
      As far as I can tell there's still no actual mechanism in existence to enforce GDPR against an entity which has no significant operations in/financial exposure to the EU. The GDPR text basically says "we'll ask other countries nicely and negotiate with them". I'll be interested to see how the first real case goes against even a US-based entity that doesn't operate in the EU, much less one based in a country like North Korea.

goldcd 7y ago

Could say they put the website into maintenance, when somebody had violated and disabled their back end. Website's "fine" - it's just waiting to be plugged into something that works.

mzs 7y ago

I don't believe that, from the journalist* "Travelex has not responded to our multiple requests for response to these allegations. Not answering calls/ texts voicemails for the last couple of hours." * https://twitter.com/joetidy/status/1214599174664138757 https://twitter.com/joetidy/status/1214599174664138757 edit: also they gave a different (spreading virus v. third party issue) statement here earlier: https://eandt.theiet.org/content/articles/2020/01/travelex-takes-its-services-offline-after-massive-cyber-attack/ https://eandt.theiet.org/content/articles/2020/01/travelex-t...