The Channel logo

News

By | John Leyden 20th December 2005 15:04

Computer forensics firm Guidance hacked

Crackers make merry with unencrypted database

Computer forensics firm Guidance Software has itself become the subject of a hack attack, prompting warnings to its clients in law enforcement and computer security that their financial details may have been exposed.

In a letter sent out last week, Guidance warned its customers that a November attack on its databases might have exposed details of its approximately 3,800 credit cards. Guidance stored customer credit details on an unencrypted database along with card value verification (CVV) numbers, a violation of merchant guidelines issued by both Visa and Mastercard. The names, addresses and telephone numbers of clients were also exposed.

New York-based computer forensics firm Kessler International, a Guidance Software client whose payment details were exposed as a result of the breach, uncovered $20,000 in unauthorized charges on its AmEx account following the attack, the Washington Post reports. The full scope of losses remains unclear. Guidance has called in the US Secret Service to help investigate the attack.

John Colbert, Guidance's chief exec, told the paper that it notified clients two days after uncovering the security breach. Following the attack, Guidance has decided to stop storing customer credit card details (a policy change that invites the question why it held those details in the first place, we'd note).

"This certainly highlights the fact that intrusions can happen to anybody and that nobody should be complacent about security," Colbert said. California-based Guidance Software was obliged to disclose the attack under the state's information security disclosure laws. News of the breach has prompted tough questions about why Guidance violated basic security guidelines on the processing of credit card details. The firm touts its ability of its EnCase software to merge computer forensics analysis with incident response yet it took it almost two weeks to detect an attack on its own systems.

Guidance cites the ongoing investigation into the attack as its reason for declining to discuss the implication of the attack. The assault on Guidance Software follows a whole bevy of internet security breaches involving major US corporations including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others over recent months. ®

alert Send corrections

Opinion

Killer whale

Chris Mellor

Firm cites 'low demand' plus 'abusers'

Tim Worstall

Or why the reversal of globalisation ain't gonna 'appen
The full Spanglish breakfast: mealy pudding, bacon, black pudding, sausages, fried egg, toast
Blood image

Trevor Pott

Can the storage giant overcome a lack of necessary leadership?

Features

No, silly... he was the fall guy for years of Finnish folly
Fraud image
Frodo and the Ring
Microsoft's strategy is to make Store apps popular. Good luck with that