The Channel logo

News

By | John Leyden 20th December 2005 15:04

Computer forensics firm Guidance hacked

Crackers make merry with unencrypted database

Computer forensics firm Guidance Software has itself become the subject of a hack attack, prompting warnings to its clients in law enforcement and computer security that their financial details may have been exposed.

In a letter sent out last week, Guidance warned its customers that a November attack on its databases might have exposed details of its approximately 3,800 credit cards. Guidance stored customer credit details on an unencrypted database along with card value verification (CVV) numbers, a violation of merchant guidelines issued by both Visa and Mastercard. The names, addresses and telephone numbers of clients were also exposed.

New York-based computer forensics firm Kessler International, a Guidance Software client whose payment details were exposed as a result of the breach, uncovered $20,000 in unauthorized charges on its AmEx account following the attack, the Washington Post reports. The full scope of losses remains unclear. Guidance has called in the US Secret Service to help investigate the attack.

John Colbert, Guidance's chief exec, told the paper that it notified clients two days after uncovering the security breach. Following the attack, Guidance has decided to stop storing customer credit card details (a policy change that invites the question why it held those details in the first place, we'd note).

"This certainly highlights the fact that intrusions can happen to anybody and that nobody should be complacent about security," Colbert said. California-based Guidance Software was obliged to disclose the attack under the state's information security disclosure laws. News of the breach has prompted tough questions about why Guidance violated basic security guidelines on the processing of credit card details. The firm touts its ability of its EnCase software to merge computer forensics analysis with incident response yet it took it almost two weeks to detect an attack on its own systems.

Guidance cites the ongoing investigation into the attack as its reason for declining to discuss the implication of the attack. The assault on Guidance Software follows a whole bevy of internet security breaches involving major US corporations including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others over recent months. ®

alert Send corrections

Opinion

Woman cuddles 'sly-looking' Fennec fox. Photo by Shutterstock
Cartoon of employee asking wky boss makes hium wear suspenders (while pincer through open trapdoor remains poised above his head) illustration by Cartoon resource for Shutterstock

Frank Jennings

It's not like my boss painstakingly nurtured the contacts, right?

Features

IBM CEO 'Ginni' Rometty
Girl and computer, photo via Shutterstock
Middle-class terror of engineering also part of problem
Nerd fail photo via Shutterstock
Shouting match
Single market vs. rest of the world