4 ms·

UPS: We’ve Been Hacked – May have compromised customer card information

43 points by markmassie 12y ago

deleted 12y ago
[deleted]
mabbo 12y ago
"The malware began to infiltrate the system as early as January 20, but the majority of the attacks began after March 26. UPS says the threat was eliminated as of August 11 and that customers can shop safely at all locations." I can't "safely shop at all locations" knowing that it took this company 6 months to stop a malware attack.
- deleted 12y ago
  [deleted]
- munin 12y ago
  if you limit your shopping to companies that can respond timely to security incidents, you won't shop at all.
  - freehunter 12y ago
    Even in the wake of Target, security at many companies is still compliance-driven and consists solely of running through a checklist to ensure you will pass an audit. There's no budget or appetite for actually securing a company's IT assets. The worst I've heard is "that would require a major shift in company culture, and we won't get buy-in". And they get hacked, the CEO loses his head, the next guy steps in, and... still nothing changes. And the security team will never be able to get a job at any other company because people blame them for everything that happened. But flip that to the startup side, and I've heard a lot of "we're a lean startup" or "security is everyone's job" so you never find a security engineer at a company with 20 employees, 19 of which are SEO and social marketing. The state of security in general is just so massively disappointing.
- superuser2 12y ago
  Yes you can, because you're not liable for credit card fraud committed against you.
  - bigdubs 12y ago
    Any claims go on your credit report, so it isn't totally true that there are zero repercussions.
    - superuser2 12y ago
      You're being downvoted because this is wrong. Some banks will allow you to essentially say, "I made this charge but I don't want to pay it." In that case, the merchant can go after you for the product you stole, and you can even be charged with shoplifting. (People might do this if they're dissatisfied with the product but can't return it, claim it didn't arrive, etc.) That could go on your credit report as an unpaid debt to the merchant you stole from. There is no credit score penalty for reporting that you saw an unauthorized transaction. The bank just wipes it out and issues you a new card. It's happened to my family multiple times.
      - notyourwork 12y ago
        Absolutely correct. I can speak from personal experience on a few occasions.
      - bigdubs 12y ago
        There is a difference between your FICO score and your credit report. There is no score penalty, but a note is made in your report that does live with you.
      - ethomson 12y ago
        It's true that this doesn't land on your credit score, but that doesn't mean that you can chargeback without anybody ever noticing. Issuing banks collect lists of credit cards that have issued chargebacks. A merchant may be able to purchase access to this list from their merchant bank. This is sort of a big hammer for a merchant to bring out: it will probably not catch any stolen cards (since those would have been cancelled as soon as the fraud was detected, before the chargeback was even processed), and it will simply block customers who have made a chargeback, without any idea of fault. The only people who would ever use this, one would presume, are at a very high risk for chargebacks and on the verge of having their merchant accounts cancelled. For example: "web sites with monthly, recurring subscriptions". You might be surprised how many men and women with teenage boys in their house dispute charges for these types of web sites!
deleted 12y ago
[deleted]
coldcode 12y ago
Payment card information. What does that mean exactly?
- freehunter 12y ago
  Payment card information is a subset of personally identifiable information (PII). Generally when someone talks about payment card information, they mean the information that is necessary to process a payment card: First and Last Name Credit Card Number (and/or PIN and/or CVV and/or routing number/account number)
cratermoon 12y ago
Oddly enough, my local UPS store installed brand new POS credit card readers a bit over a week ago. It's not listed on the ones affected, but now I believe I understand the timing.

43 points by markmassie 12y ago

deleted 12y ago

[deleted]

mabbo 12y ago

"The malware began to infiltrate the system as early as January 20, but the majority of the attacks began after March 26. UPS says the threat was eliminated as of August 11 and that customers can shop safely at all locations." I can't "safely shop at all locations" knowing that it took this company 6 months to stop a malware attack.

deleted 12y ago
[deleted]
munin 12y ago
if you limit your shopping to companies that can respond timely to security incidents, you won't shop at all.
- freehunter 12y ago
  Even in the wake of Target, security at many companies is still compliance-driven and consists solely of running through a checklist to ensure you will pass an audit. There's no budget or appetite for actually securing a company's IT assets. The worst I've heard is "that would require a major shift in company culture, and we won't get buy-in". And they get hacked, the CEO loses his head, the next guy steps in, and... still nothing changes. And the security team will never be able to get a job at any other company because people blame them for everything that happened. But flip that to the startup side, and I've heard a lot of "we're a lean startup" or "security is everyone's job" so you never find a security engineer at a company with 20 employees, 19 of which are SEO and social marketing. The state of security in general is just so massively disappointing.
superuser2 12y ago
Yes you can, because you're not liable for credit card fraud committed against you.
- bigdubs 12y ago
  Any claims go on your credit report, so it isn't totally true that there are zero repercussions.
  - superuser2 12y ago
    You're being downvoted because this is wrong. Some banks will allow you to essentially say, "I made this charge but I don't want to pay it." In that case, the merchant can go after you for the product you stole, and you can even be charged with shoplifting. (People might do this if they're dissatisfied with the product but can't return it, claim it didn't arrive, etc.) That could go on your credit report as an unpaid debt to the merchant you stole from. There is no credit score penalty for reporting that you saw an unauthorized transaction. The bank just wipes it out and issues you a new card. It's happened to my family multiple times.
    - notyourwork 12y ago
      Absolutely correct. I can speak from personal experience on a few occasions.
    - bigdubs 12y ago
      There is a difference between your FICO score and your credit report. There is no score penalty, but a note is made in your report that does live with you.
    - ethomson 12y ago
      It's true that this doesn't land on your credit score, but that doesn't mean that you can chargeback without anybody ever noticing. Issuing banks collect lists of credit cards that have issued chargebacks. A merchant may be able to purchase access to this list from their merchant bank. This is sort of a big hammer for a merchant to bring out: it will probably not catch any stolen cards (since those would have been cancelled as soon as the fraud was detected, before the chargeback was even processed), and it will simply block customers who have made a chargeback, without any idea of fault. The only people who would ever use this, one would presume, are at a very high risk for chargebacks and on the verge of having their merchant accounts cancelled. For example: "web sites with monthly, recurring subscriptions". You might be surprised how many men and women with teenage boys in their house dispute charges for these types of web sites!

deleted 12y ago

[deleted]

coldcode 12y ago

Payment card information. What does that mean exactly?

freehunter 12y ago
Payment card information is a subset of personally identifiable information (PII). Generally when someone talks about payment card information, they mean the information that is necessary to process a payment card: First and Last Name Credit Card Number (and/or PIN and/or CVV and/or routing number/account number)

cratermoon 12y ago

Oddly enough, my local UPS store installed brand new POS credit card readers a bit over a week ago. It's not listed on the ones affected, but now I believe I understand the timing.