5 ms·

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDetail.htm https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well,

by aroch 13y ago

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDetail.htm https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe... Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the actual customers product. Additionally, I'm willing to bet quite a few of these people have used the listed email and last 4 for other things online and/or for verification of identify places. Also, how is this PCI compliant?

freehunter 13y ago
There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII. I work information security but I am not on my company's compliance team, so I'm familiar with PCI/SOX but not steeped in it. I believe the above is true, but I'm not an auditor. As far as trying to gain a copy of the information in the email, it might be possible if you were willing to put your own email on record as being part of this data breech. It's also possible that the only thing contained in the email is purchase confirmation (aka, what is shown in the printable invoice).
- pchap10k 13y ago
  Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.
  - jarito 13y ago
    Correct. From the DSS, 'Cardholder data includes: Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code'
    - wmboy 13y ago
      This is not true, I used to work in the industry and you can use a hosted credit card solution (where you transfer customers to a secure payment page) without needing PCI compliance. If it were correct, and the card holder name needed to be secure, the company I worked at would not have received level 1 PCI compliance. The solution sends back the truncated card number, expiry date and the full card holder name. Of course I'm assuming the banks wouldn't want you to make that data public, but you are allowed to store it without needing to be PCI compliant. CVV code is another matter, under no circumstances are you allowed to store it, unless you're a level 1 compliant payment processor.
      - nexfina 13y ago
        Phew! At least we can all take comfort in the fact that ClickBank is a Level 1 compliant payment processor. http://www.clickbank.com/press/clickbank-achieves-level-1-payment-card-industry-pci-compliance-certification/ http://www.clickbank.com/press/clickbank-achieves-level-1-pa...
- nexfina 13y ago
  Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant. https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF7 https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)
  - wmboy 13y ago
    PCI is designed to protect credit card fraud, not customer's address information. Banks don't care about the risk of identify theft, but rather credit card fraud.
hbbio 13y ago
You can also (re)download the super expensive scammy ebooks. And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbreceipt=L5RRBCPE&time=1304889316&cbpop=68351863&cbaffi=0&cupsellreceipt=8RRRNEXY&cname=Ronnie+Hudson&cemail=rcbhudson%40mindspring.com&ccountry=US&czip=30066&cbur=a http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...
- rk0567 13y ago
  True, I did one - "Mastering the skill of Blah Blah.."
  - hbbio 13y ago
    Does not beat "How to pull your ex (Female version)"
- JeremyMorgan 13y ago
  It's not all expensive scammy ebooks, but "most" is probably an accurate assumption. I've actually purchased some useful software from a company using clickbank, but for the most part it's a strange part-pyramid scam type of thing with ebooks that tell you how to make your own part-pyramid scam business.

by aroch 13y ago

freehunter 13y ago

There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII. I work information security but I am not on my company's compliance team, so I'm familiar with PCI/SOX but not steeped in it. I believe the above is true, but I'm not an auditor. As far as trying to gain a copy of the information in the email, it might be possible if you were willing to put your own email on record as being part of this data breech. It's also possible that the only thing contained in the email is purchase confirmation (aka, what is shown in the printable invoice).

pchap10k 13y ago
Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.
- jarito 13y ago
  Correct. From the DSS, 'Cardholder data includes: Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code'
  - wmboy 13y ago
    This is not true, I used to work in the industry and you can use a hosted credit card solution (where you transfer customers to a secure payment page) without needing PCI compliance. If it were correct, and the card holder name needed to be secure, the company I worked at would not have received level 1 PCI compliance. The solution sends back the truncated card number, expiry date and the full card holder name. Of course I'm assuming the banks wouldn't want you to make that data public, but you are allowed to store it without needing to be PCI compliant. CVV code is another matter, under no circumstances are you allowed to store it, unless you're a level 1 compliant payment processor.
    - nexfina 13y ago
      Phew! At least we can all take comfort in the fact that ClickBank is a Level 1 compliant payment processor. http://www.clickbank.com/press/clickbank-achieves-level-1-payment-card-industry-pci-compliance-certification/ http://www.clickbank.com/press/clickbank-achieves-level-1-pa...
nexfina 13y ago
Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant. https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF7 https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)
- wmboy 13y ago
  PCI is designed to protect credit card fraud, not customer's address information. Banks don't care about the risk of identify theft, but rather credit card fraud.

hbbio 13y ago

You can also (re)download the super expensive scammy ebooks. And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbreceipt=L5RRBCPE&time=1304889316&cbpop=68351863&cbaffi=0&cupsellreceipt=8RRRNEXY&cname=Ronnie+Hudson&cemail=rcbhudson%40mindspring.com&ccountry=US&czip=30066&cbur=a http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...

rk0567 13y ago
True, I did one - "Mastering the skill of Blah Blah.."
- hbbio 13y ago
  Does not beat "How to pull your ex (Female version)"
JeremyMorgan 13y ago
It's not all expensive scammy ebooks, but "most" is probably an accurate assumption. I've actually purchased some useful software from a company using clickbank, but for the most part it's a strange part-pyramid scam type of thing with ebooks that tell you how to make your own part-pyramid scam business.