Newspapers Wrapped in Credit Card Data 150
Buzzy's Roast Beef writes "The Boston Globe reports that bundles of newspapers in Worcester, MA were distributed wrapped in paper which contained subscriber credit card information for 240,000 customers. Those of you paying by check needn't worry; account and routing details for 1,100 customers paying by check were also given out like candy." From the article: "Larkin said the newspapers were first notified of the security breach on Monday by a clerk at a Cumberland Farms store. It took until late Monday for officials to confirm the data on the back of the paper were credit and debit card numbers. Senior management learned of the security breach yesterday morning, Larkin said. The company put out a news release late yesterday afternoon."
Access Control (Score:5, Interesting)
The article explained the mistakes, which were caused by aborted print jobs, only those printed documents were in the bin for recycling!
At least the the newspapers have now added a safeguard to the computer system so only the last four numbers of credit and debit cards can be printed.
Need to print the data? (Score:5, Interesting)
Heh. (Score:5, Interesting)
So you see there is a financial subset inside circulation that deals with that billing info, which is why they have access to it. The reason it doesn't go straight to accounting is because, in most papers, accounting deals almost exclusively with advertising revenue and billing, which is a lot more complex than 15 bucks a month, or whatever the news subscription rate is, which gets billed automatically.
All that being said, it took some kinda dumbass to dump that info out on the toppers, and a whole crew of dumbasses down the line to attach that information to the paper. Most places don't put anything like personal information on the toppers for papers they're distributing, so it should have been obvious to anyone that there had been a mistake...There are a LOT of people who should have noticed something was wrong.
I was on the list (Score:3, Interesting)
So I had to cancel my card and get a new one.
It's too bad the Herald is such a rag or I'd drop my subscription today. Maybe I will anyway and just get my news off the web like everyone else.. but I so love to curl up with my coffee and paper on sunday mornings...
insane (Score:2, Interesting)
Since having your identity stolen is so difficult to recover from I think anyone that has had thier info. sent out should sue if thier identity is stolen. Then the company gets to pay for the next five years of credit cleanup for the person.
Hit'em in the pocketbook and they'll pay more attention.
Re:Need to print the data? (Score:3, Interesting)
> counsel can use in a trusted and secure method.
I can understand that for certain legal -purposes- this may be necessary. Is is strictly necessitated by law, however? Federal or state?
For security reasons, many firms don't store the credit card numbers after processing the transaction (obviously, doesn't apply to any regularly repeated transactions/subscriptions).
Is this solely required for repeating transactions?
Freedom of the Press? (Score:2, Interesting)
Worse still, we've now found out (in a round-a-bout fashion) that they been 'recycling' these credit card 'reports'. So that means for countless years, the people have just been 'giving' private/confidential/sensitive information to another company? Depending on who does the recycling, this trash may even be public property (like residential trash taken to the curb). I hope for damn sure they have a contract with this company that dictates the terms of use for this material and that it includes a clause defining the destruction of financial data.
I guess 'Freedom of the Press' has a new meaning now, eh?
Similar thing happened to me, maybe you too (Score:4, Interesting)
Two Words: Rights Management (Score:3, Interesting)
For example, whenever a card number is typed into the database and updated it will only show the last four digits to any human. I would assume Circulation Accounting could track down the transaction and find the number that way, but as far as I know the full card number is only given up electronically. What is the point of even having a list of card numbers printed on paper? Why would that even be close to the circulation field staff? I would ask the CIO why the field staff needs credit card numbers.
Then you come to another point - are the carriers working for themselves? If so, then the liability may just fall on that one person. It seems the newspaper is picking up some responsibility so I assume they are employed by the newspaper. Then the question goes back to the IT departments: Why can users access information they do not need?
Almost sounds like someone did it on purpose, you never know.
The Globe Is Dying (Score:2, Interesting)