Creative Leisure News

Technology issues that affect your business

Dealing with a Hacked Website

How to handle an awful situation.

Edited by Mike Hartnett (July 20, 2005)

(Note: Hackers breaking into websites and stealing identity and credit card information is becoming a depressingly common occurrence. And it's not just huge credit card and insurance companies � it's happening in our industry, too. A well known industry vendor recently had the e-commerce section of its site hacked. CLN is not interested in embarrassing the company � because it could probably happen to any of us � but rather to warn subscribers of the danger.

CLN also believes this vendor handled the situation about as well as it could be. So we're reprinting the emails sent to the vendor's customers as an example of how to handle the situation of it happens to you.)

Email from the company webmaster.

We are writing to inform you of a recent incident that may have exposed you to identity theft. This e-mail is intended to provide timely notification; a letter containing this information will also be sent to you via U.S. mail.

On May 31, 2005 we were alerted to a possible security breach to our website shopping cart and subsequently shutdown the e-commerce portion of our website until we could verify and fix the problem. Upon investigation, we believe a file containing order information (specifically names and credit card numbers) was compromised.

To protect yourself, our company is recommending that you immediately contact your credit card issuer and close your account. Tell them that your account may have been compromised. If you want to open a new account, ask your credit card issuer to give you a PIN or password. This will help control access to the account.

To further protect yourself, we recommend that you place a fraud alert on your credit file. A fraud alert lets creditors know to contact you before opening new accounts. Just call any one of the three credit reporting agencies at the number below. This will let you automatically place fraud alerts and order your credit report from all three.

Equifax: (800) 525-6285

Experian: (888) 397-3742

TransUnion: (800) 680-7289

When you receive your credit reports, review them carefully. Look for accounts you did not open, inquires from creditors that you did not initiate, and for personal information that is not correct, such as your home address and Social Security number. If you see anything you do not understand, call the credit agency at the telephone number on the report.

If you find any suspicious activity on your credit reports, call your local police or sheriff s office and file a report of identity theft. Get a copy of the police report. You may need to give copies to creditors to clean up your records.

Even if you do not find any signs of fraud on your report, we recommend that you check your credit reports every three months for the next year. Just call one of the numbers above to order your reports and keep the fraud alert in place.

For more information on identity theft and to file a compliant with the Federal Trade Commission s Bureau of Consumer Protection, visit www.consumer.gov/idtheft or call (877) 382-4357. If there is anything we can do to assist you, please call us at ....

Email from the company president.

We re sending this message with the attached document to let you know that the shopping cart on our website was breached last week by an unknown hacker, and there s the likelihood that some credit card information was stolen. We ve heard from a handful of our online customers that their credit card companies have notified them of misuse of their cards.

We ve been able to isolate the list of customers who might have been affected including you and we re making this preemptive contact with you so you can take steps to protect yourself. Your best course is to cancel the credit card and check your credit report, as described in the attached document.

You can imagine our dismay, and our deep regret for the inconvenience this is causing you. We ve spent many hours closing the breach and putting in place security procedures intended to prevent this kind of online breach from happening again. We appreciate your understanding, and hope that you will call us at .... if there s any way we can be of service.

(Note: To read previous Tech Topics columns, click on the titles in the right-hand column. To comment on this or any other industry issue, email CLN at www.clnonline.com.)

xxx