Certegy breach worse than reported

Share this article:

The number of consumer records sold to a data broker by a former Certegy Check Services database administrator is actually 8.5 million, about 6 million more than originally reported.

In a filing with the U.S. Securities and Exchange Commission, Fidelity National Information Services, the parent of St. Petersburg, Fla.-based Certegy, reported some of the stolen records only contained names, addresses, telephone numbers and birth dates.

But, about 5.7 million contained checking account numbers and 1.5 million included credit card numbers, according to last week's filing. And the company conceded that more affected records may be identified as the investigation continues.

The former employee, whom Certegy has filed a civil lawsuit against, sold the records to a number of direct marketing firms, but so far, none of the data has been used fraudulently.

"As a result of this apparent theft, the consumers affected received marketing solicitations from the companies that bought the data," Renz Nichols, Certegy president, said in a July 3 statement, which had then estimated the number of stolen records at 2.3 million.

The company continues to warn users on its home page that they must be wary of solicitations from people claiming to be Certegy employees who seek their personal information.

"Please be advised that Certegy’s call center is NOT making any outbound calls to consumers," the statement said. "In fact, the call center staff does not have access to individual consumer information. [Instead] they are available to help those impacted understand what steps can be taken to safeguard their information."

Adam Bosnian, vice president of products and strategies at identity and access management provider Cyber-Ark Software, told SCMagazine.com today that organizations often blindly trust their database administrators (DBAs).

"Organizations need to be aware that these insider incidents are often done by the people with privileged access," he said, adding that DBAs often do their jobs with little or no scrutiny.

Instead businesses must implement monitoring tools and protocols for approving database changes, he said.

 

Click here to email reporter Dan Kaplan.

Share this article:

Sign up to our newsletters

More in News

Research shows vulnerabilities go unfixed longer in ASP

Research shows vulnerabilities go unfixed longer in ASP

A new report finds little difference in the number of vulnerabilities among programming languages, but remediation times vary widely.

Bill would restrict Calif. retailers from storing certain payment data

The bill would ban businesses from storing sensitive payment data, for any long than required, even if it is encrypted.

Amplification, reflection DDoS attacks increase 35 percent in Q1 2014

Amplification, reflection DDoS attacks increase 35 percent in ...

The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise.