6 ms·

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

vaxman 3y ago
Yep, that vendor is a major HMO for Defense workers with Top Secret clearances. Does SiteLink have issues too? I think they do.
robertlagrant 3y ago
Why they are doing their own payments processing is beyond me. Is it just too expensive to use someone like Stripe?
- packetlost 3y ago
  Stripe? Oh yeah. At their scale, they'd likely be talking to Fidelity or some other big player directly.
- mrweasel 3y ago
  I was going to ask something similar. Especially US companies seems rather fond of storing credit card information, but I never seem it done in Denmark, regardless of the size of the company. The most common solution is to let your payment processor deal with those sorts of things, you just have a token, which can only be used to deposit money into your account. So even if it's stolen or leaked, you can transfer the money back, they can't be transferred to a third party. Why on earth you'd want to deal with credit card information and the attacks it attracts is beyond me. It's not like you're locked to the your provider, the tokens can be transferred... Not easily, but it can be done. And no, companies would never pay Stripes asking price. You can negotiate much much lower rates with companies like Valitor/Rapyd or certain banks.
  - Kalium 3y ago
    For a long time, payment processors in the US would charge more to offer tokenization services. Cost-conscious companies with an eye on their unit economics reacted in predictable ways.
    - mrweasel 3y ago
      > Cost-conscious companies with an eye on their unit economics reacted in predictable ways. That seems like the likely explanation. I don't know what the additional cost would be, but with 7 million customers, it could be a million dollars a year in saving. That would require you to be able to be PCI compliant for less than that amount and the risk is still considerable, you could lose your VISA or MasterCard contract pretty quickly and then you're out of business. We had a situation where scammers would use our site to check stolen credit cards, we got at most 7 days to handle the problem or VISA would close our account. I'd imagine that failing out of compliance would hit equally hard.
- wayfinder 3y ago
  I used to work at a medium-sized non-tech company (<200 employees) that had a fair amount of IT staff. Stripe is expensive asf and we always talked with banks and payment processors directly. We never stored CVVs or any of that insane nonsense though. Our systems only ever saw CC info in transit but they were never stored on-site. God I miss that company. Working with smart people is great.
fatnoah 3y ago
It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or convenience conflicts with proper data security, I ask people to envision how our processes would look as a news headline or would fare in a legal discovery.
- ngneer 3y ago
  Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?
  - fatnoah 3y ago
    > or is the main incentive to be able to tout compliance? At the time I joined, the existing goals were around compliance and checking boxes on security questionnaires, which is exactly the problem I'm trying to solve. Specifically, compliance was driven by the IT/Infra teams and mostly around access to access to cloud infra. That's obviously useless if a db server is locked down and change managed, but the software access the data isn't. So, the bulk of my efforts in this area have been around bridging the gap from checking boxes to actual compliance with various standards. Fortunately, we rely heavily on data, so it's not a hard sell to properly protect things. In general, people receive the questions well, as it makes the strong point that there's a big gap between checking a box that people in sales & marketing care about, vs. how any issues arising from not having "real" compliance would be catastrophic and business ending for a company of our size.
  - neilv 3y ago
    > what is people's typical response and what is the dynamic? Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems. One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol. When I started to tell the director to whom I reported, I felt an initial "oh no..." mixed with skepticism, from hints in their voice. So I explained, and answered their questions. Then they seemed to switch from dread, to solving it. Instead of quietly taking the client's money, they halted integration, and put together a presentation for the customer, telling them how part of their security had a grave problem. (Possibly awkward, because it might've been a team internal to the customer who had made such a mistake on something so sensitive.) I'd say that the dynamic in that case was what you'd like to imagine from engineers who'd risen in influence: acknowledging the problem, understanding and doing the right thing, when it had to be done, even when they wish it didn't.
silveira 3y ago
That's a good point. The best way to not leak a secret is to not have the secret in the first place. I don't know anything of PCI rules but I would imagine there is a way to implement the feature "store this credit card information for future purchases" without storing the raw credit card information.
- csunbird 3y ago
  Yes, you ask for an authorization token for recurring payments from your payment provider if you intend to make subsequent charges from that card. Then you store that token only (and maybe last 4 digits of the card for the customer’s convenience) and use the token without any other card information to make charges.
- deleted 3y ago
  [deleted]
coldcode 3y ago
I assume they kept these in a database, which was sent or exported in some way to use Move-IT to transfer somewhere else. The hack was at Move-IT's servers I think, which allowed people to read the contents. The question I have is was this information encrypted by DD or did they just assume Move-IT was safe? If the latter, it's pretty stupid.
- paulcole 3y ago
  I’ve done a lot of research into HIPAA (I work in a dental-adjacent field) and my guess is that it’s almost certainly the latter – an assumption, maybe based on something they were told. But it’s still on them regardless of whether they were deceived or simply didn’t ask. There have been very few dental practices who have paid fines for HIPAA violations and one that stands out is one who hired a document shredding firm to destroy old paper patient records. The shredders pick up a bunch of files and just drove around the corner and hucked them into an open dumpster where they were found. The dentist was fined as the result of their assumption that a document shredding firm would, you know, shred documents.
  - Scoundreller 3y ago
    Not USA, but we had a case where the discarded unshredded health files somehow ended up being used in a movie shoot for “special effects” and strewn all over a street somewhere. https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135056/index.do?site_preference=normal https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135056/i... Another where a manager lit a big bonfire at home but put in too much at a time and they asteroided around in burnt and unburnt manner. Pre-tech breaches :)
ryandrake 3y ago
> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number; string expiration_date; string insecurity_code; }; ...to complete a credit card transaction. At some point that record is in a computer or in your restaurant waiter's brain, so it's vulnerable to exfiltration, regardless of what part of that record gets redacted for long term storage. We are living in a world with bozos in charge who can't seem to develop a secure payment system, so we as users need to simply assume that all information required to make a purchase on our behalf is public knowledge, and instead diligently check our records for inaccuracies. I don't sweat these "breaches" because I freeze my credit and review all my bank and credit card transactions daily now.
- gosub100 3y ago
  its not silly just because it can't solve all problems. It goes a long way to gas station type skimmers less valuable because you can't print a phony card from them, or the phony card you can print is limited to a subset of possible purchases. perfect-enemy-of-good yadayda.
  - gunapologist99 3y ago
    You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.
    - ryandrake 3y ago
      I tried to better clarify what I'm saying in [1]. I'm not saying the small number of digits makes it insecure, it's that "moar numbers" is not really adding anything in terms of multi-factor or secrecy. Instead of knowing N digits, you merely need to know N+M digits. It is not changing the nature of the secret. 1: https://news.ycombinator.com/item?id=38655609 https://news.ycombinator.com/item?id=38655609
lovecg 3y ago
They won’t and it won’t be.
- 93po 3y ago
  Hey come on, when Target had their data breach in 2015 due to massive negligence and incompetence, the largest data breach ever to date, they had to pay about 1.6% of their average net income at the time in penalties. I imagine Delta will pay less than that since, you know, it isn't as bad.
wrs 3y ago
Storing the CVV would be very bad, but the form they’re linking to is ambiguous: “Information Acquired - Name or other personal identifier in combination with: Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account)”
AndrewKemendo 3y ago
I find this especially ironic given the fact that most tech companies I’ve been at used Delta dental of California I feel like we all deserve this somehow for allowing bad practices like this to proliferate in the favor of business objectives
- koolba 3y ago
  Delta is like the Blue Cross of dental plans.
andrei_says_ 3y ago
I use delta dental. What does this mean? Why would they store my CC info when I’m paying directly to my dentist and delta dental is also paying the dentist? How does my CC info get transferred to the insurer? There’s no such transaction afaik.
- calfuris 3y ago
  How are you paying your premium? For individual plans, I suspect that a lot of people use a card.
  - accrual 3y ago
    At least at my $dayjob, premiums are deducted before I get my check, along with taxes, retirement, etc. Like you mentioned, it's probably different for those who purchase their own insurance.
  - andrei_says_ 3y ago
    Employer.
- CWuestefeld 3y ago
  the OP says "Delta Dental of California", for one thing. I imagine that means that I'm safe. California is not the entire world, believe it or not.
trimethylpurine 3y ago
That would just force the company to form back up with the same people under a new name. Unless individuals can be held responsible, there's nothing we can do about it.

vaxman 3y ago

Yep, that vendor is a major HMO for Defense workers with Top Secret clearances. Does SiteLink have issues too? I think they do.

robertlagrant 3y ago

Why they are doing their own payments processing is beyond me. Is it just too expensive to use someone like Stripe?

packetlost 3y ago
Stripe? Oh yeah. At their scale, they'd likely be talking to Fidelity or some other big player directly.
mrweasel 3y ago
I was going to ask something similar. Especially US companies seems rather fond of storing credit card information, but I never seem it done in Denmark, regardless of the size of the company. The most common solution is to let your payment processor deal with those sorts of things, you just have a token, which can only be used to deposit money into your account. So even if it's stolen or leaked, you can transfer the money back, they can't be transferred to a third party. Why on earth you'd want to deal with credit card information and the attacks it attracts is beyond me. It's not like you're locked to the your provider, the tokens can be transferred... Not easily, but it can be done. And no, companies would never pay Stripes asking price. You can negotiate much much lower rates with companies like Valitor/Rapyd or certain banks.
- Kalium 3y ago
  For a long time, payment processors in the US would charge more to offer tokenization services. Cost-conscious companies with an eye on their unit economics reacted in predictable ways.
  - mrweasel 3y ago
    > Cost-conscious companies with an eye on their unit economics reacted in predictable ways. That seems like the likely explanation. I don't know what the additional cost would be, but with 7 million customers, it could be a million dollars a year in saving. That would require you to be able to be PCI compliant for less than that amount and the risk is still considerable, you could lose your VISA or MasterCard contract pretty quickly and then you're out of business. We had a situation where scammers would use our site to check stolen credit cards, we got at most 7 days to handle the problem or VISA would close our account. I'd imagine that failing out of compliance would hit equally hard.
wayfinder 3y ago
I used to work at a medium-sized non-tech company (<200 employees) that had a fair amount of IT staff. Stripe is expensive asf and we always talked with banks and payment processors directly. We never stored CVVs or any of that insane nonsense though. Our systems only ever saw CC info in transit but they were never stored on-site. God I miss that company. Working with smart people is great.

fatnoah 3y ago

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or convenience conflicts with proper data security, I ask people to envision how our processes would look as a news headline or would fare in a legal discovery.

ngneer 3y ago
Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?
- fatnoah 3y ago
  > or is the main incentive to be able to tout compliance? At the time I joined, the existing goals were around compliance and checking boxes on security questionnaires, which is exactly the problem I'm trying to solve. Specifically, compliance was driven by the IT/Infra teams and mostly around access to access to cloud infra. That's obviously useless if a db server is locked down and change managed, but the software access the data isn't. So, the bulk of my efforts in this area have been around bridging the gap from checking boxes to actual compliance with various standards. Fortunately, we rely heavily on data, so it's not a hard sell to properly protect things. In general, people receive the questions well, as it makes the strong point that there's a big gap between checking a box that people in sales & marketing care about, vs. how any issues arising from not having "real" compliance would be catastrophic and business ending for a company of our size.
- neilv 3y ago
  > what is people's typical response and what is the dynamic? Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems. One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol. When I started to tell the director to whom I reported, I felt an initial "oh no..." mixed with skepticism, from hints in their voice. So I explained, and answered their questions. Then they seemed to switch from dread, to solving it. Instead of quietly taking the client's money, they halted integration, and put together a presentation for the customer, telling them how part of their security had a grave problem. (Possibly awkward, because it might've been a team internal to the customer who had made such a mistake on something so sensitive.) I'd say that the dynamic in that case was what you'd like to imagine from engineers who'd risen in influence: acknowledging the problem, understanding and doing the right thing, when it had to be done, even when they wish it didn't.

silveira 3y ago

That's a good point. The best way to not leak a secret is to not have the secret in the first place. I don't know anything of PCI rules but I would imagine there is a way to implement the feature "store this credit card information for future purchases" without storing the raw credit card information.

csunbird 3y ago
Yes, you ask for an authorization token for recurring payments from your payment provider if you intend to make subsequent charges from that card. Then you store that token only (and maybe last 4 digits of the card for the customer’s convenience) and use the token without any other card information to make charges.
deleted 3y ago
[deleted]

coldcode 3y ago

I assume they kept these in a database, which was sent or exported in some way to use Move-IT to transfer somewhere else. The hack was at Move-IT's servers I think, which allowed people to read the contents. The question I have is was this information encrypted by DD or did they just assume Move-IT was safe? If the latter, it's pretty stupid.

paulcole 3y ago
I’ve done a lot of research into HIPAA (I work in a dental-adjacent field) and my guess is that it’s almost certainly the latter – an assumption, maybe based on something they were told. But it’s still on them regardless of whether they were deceived or simply didn’t ask. There have been very few dental practices who have paid fines for HIPAA violations and one that stands out is one who hired a document shredding firm to destroy old paper patient records. The shredders pick up a bunch of files and just drove around the corner and hucked them into an open dumpster where they were found. The dentist was fined as the result of their assumption that a document shredding firm would, you know, shred documents.
- Scoundreller 3y ago
  Not USA, but we had a case where the discarded unshredded health files somehow ended up being used in a movie shoot for “special effects” and strewn all over a street somewhere. https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135056/index.do?site_preference=normal https://decisions.ipc.on.ca/ipc-cipvp/phipa/en/item/135056/i... Another where a manager lit a big bonfire at home but put in too much at a time and they asteroided around in burnt and unburnt manner. Pre-tech breaches :)

ryandrake 3y ago

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number; string expiration_date; string insecurity_code; }; ...to complete a credit card transaction. At some point that record is in a computer or in your restaurant waiter's brain, so it's vulnerable to exfiltration, regardless of what part of that record gets redacted for long term storage. We are living in a world with bozos in charge who can't seem to develop a secure payment system, so we as users need to simply assume that all information required to make a purchase on our behalf is public knowledge, and instead diligently check our records for inaccuracies. I don't sweat these "breaches" because I freeze my credit and review all my bank and credit card transactions daily now.

gosub100 3y ago
its not silly just because it can't solve all problems. It goes a long way to gas station type skimmers less valuable because you can't print a phony card from them, or the phony card you can print is limited to a subset of possible purchases. perfect-enemy-of-good yadayda.
- gunapologist99 3y ago
  You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.
  - ryandrake 3y ago
    I tried to better clarify what I'm saying in [1]. I'm not saying the small number of digits makes it insecure, it's that "moar numbers" is not really adding anything in terms of multi-factor or secrecy. Instead of knowing N digits, you merely need to know N+M digits. It is not changing the nature of the secret. 1: https://news.ycombinator.com/item?id=38655609 https://news.ycombinator.com/item?id=38655609

lovecg 3y ago

They won’t and it won’t be.

93po 3y ago
Hey come on, when Target had their data breach in 2015 due to massive negligence and incompetence, the largest data breach ever to date, they had to pay about 1.6% of their average net income at the time in penalties. I imagine Delta will pay less than that since, you know, it isn't as bad.

wrs 3y ago

Storing the CVV would be very bad, but the form they’re linking to is ambiguous: “Information Acquired - Name or other personal identifier in combination with: Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account)”

AndrewKemendo 3y ago

I find this especially ironic given the fact that most tech companies I’ve been at used Delta dental of California I feel like we all deserve this somehow for allowing bad practices like this to proliferate in the favor of business objectives

koolba 3y ago
Delta is like the Blue Cross of dental plans.

andrei_says_ 3y ago

I use delta dental. What does this mean? Why would they store my CC info when I’m paying directly to my dentist and delta dental is also paying the dentist? How does my CC info get transferred to the insurer? There’s no such transaction afaik.

calfuris 3y ago
How are you paying your premium? For individual plans, I suspect that a lot of people use a card.
- accrual 3y ago
  At least at my $dayjob, premiums are deducted before I get my check, along with taxes, retirement, etc. Like you mentioned, it's probably different for those who purchase their own insurance.
- andrei_says_ 3y ago
  Employer.
CWuestefeld 3y ago
the OP says "Delta Dental of California", for one thing. I imagine that means that I'm safe. California is not the entire world, believe it or not.

trimethylpurine 3y ago

That would just force the company to form back up with the same people under a new name. Unless individuals can be held responsible, there's nothing we can do about it.