• Howdy! Welcome to our community of more than 130.000 members devoted to web hosting. This is a great place to get special offers from web hosts and post your own requests or ads. To start posting sign up here. Cheers! /Peo, FreeWebSpace.net
managed wordpress hosting

WHT CC Info Leaked!

E

Eclouds

Marketing Guru
NLC
This was posted at webhostingboard by Mike Denney.

Hello,

WebHostingTalk.com has been compromised once again but this time the Credit Card details portion of their database was compromised and is now circling the internet as "WHT_XXXX_XXXXXXX_XX.rar". This file contains *thousands* of credit cards with complete details including Credit Card Number, CVV2 Number, Full Name, Bank Name, as well as some other details.

If you have *ever* entered your credit card information at WebHostingTalk be it for a Premium Membership or any other reason you need to contact your bank IMMEDIATELY and cancel the card and be issued a new one. I would also advise you to let your bank know what has happened so that if you need to fight some fraudulent charges your bank will know what is going on.

Keep in mind I am not trying to damage WHT any further by posting this, it seems that this information is being kept "hush hush" when those affected need to be notified so they can pro-actively protect themselves against fraud.

Please - direct anybody you know that may have used their Credit Card at webhostingtalk.com to this thread and feel free to update this thread with pertinent *verifiable* information.

Thank you.
Click to expand...
 
Didn't they say CC info was on another server? I can't remember the details, but I know if I got hacked I'd expect the hacker to go for CC information first. Post/threads and deletion of backups is meaningless, just causes headace and mayhem with no real self gain.
 
It's just getting worse it seems. Hopefully they get it all sorted out soon.

Another update from iNet Interactive:

UPDATE: 4:24pm est

We have contacted all major credit card companies and are awaiting their guidance. It should be noted that card holders will not be held liable for any fraudulent purchase made using their credit card.
Click to expand...
 
Only time will tell what happens.

All I can say is that drastic changes in security need to be made, and that everyone should use this as a prime example of poor security practices.
 
I thought Rackspace had them covered?
Also, why did they contact the credit card companies? Was it due to them storing personal credentials on their servers?
 
Even so, back to my question. Why did they contact the credit card companies? All CC information is temporarily stored, right?
 
They had transactions from as far back at 2007 stored which were not encrypted. This lead to many CC #'s being released.
 
Even if you decide to store them, they should at least be encrypted.

Failing to encrypt and storing them leads to issues such as this.
 
If I remember again, they posted once before that CC info wasn't taken and was safe, along with it being encrpyted? Unless I'm just pulling this from thin air. I'm sure it's somewhere in the first thread of WHT downtime.
 
It was the user table that was released right after the hacking occurred. It was not until today that the credit card information was released which was not encrypted. The user table did have weakly encrypted passwords.
 
There is some sort of industry standard encryption you have to use if you store cc numbers, I'm not sure if you have to pay anything as well...
 
Well stuff - WHT did not use any sort of encryption, not even the bog standard one that your meant to use by law.

I can see quite a few law suits coming out of this problem.

WHT has been Arrogant for quite a time, and now, the tables are turning. They cut corners, and its biting them on the ---.
 
Their site shows that the CCs are from a while ago though.. the new orders are safe. It seems that they just didn't delete the CC #'s from a long time ago, which they should've done a long time ago...
 
You misread. New memberships are protected, but new sticky thread advertisement costs are not. Also, most CCs have at least a 3 year activation span which makes about 80% still active.
 
New premium memberships use paypal as far as I can remember and paypal should be used for all future transactions from now on. The company needs to keep the paypal password away from any server that they use. Instead of checking the security of the server(s), they need to reload the OS of all of the servers just in case the hackers have access to the servers right as of now. How do they know if an employee isn't working with a hacker etc.?
 
You must log in or register to reply here.
Back
Top