The Channel logo

News

By | John Leyden 20th December 2005 15:04

Computer forensics firm Guidance hacked

Crackers make merry with unencrypted database

Computer forensics firm Guidance Software has itself become the subject of a hack attack, prompting warnings to its clients in law enforcement and computer security that their financial details may have been exposed.

In a letter sent out last week, Guidance warned its customers that a November attack on its databases might have exposed details of its approximately 3,800 credit cards. Guidance stored customer credit details on an unencrypted database along with card value verification (CVV) numbers, a violation of merchant guidelines issued by both Visa and Mastercard. The names, addresses and telephone numbers of clients were also exposed.

New York-based computer forensics firm Kessler International, a Guidance Software client whose payment details were exposed as a result of the breach, uncovered $20,000 in unauthorized charges on its AmEx account following the attack, the Washington Post reports. The full scope of losses remains unclear. Guidance has called in the US Secret Service to help investigate the attack.

John Colbert, Guidance's chief exec, told the paper that it notified clients two days after uncovering the security breach. Following the attack, Guidance has decided to stop storing customer credit card details (a policy change that invites the question why it held those details in the first place, we'd note).

"This certainly highlights the fact that intrusions can happen to anybody and that nobody should be complacent about security," Colbert said. California-based Guidance Software was obliged to disclose the attack under the state's information security disclosure laws. News of the breach has prompted tough questions about why Guidance violated basic security guidelines on the processing of credit card details. The firm touts its ability of its EnCase software to merge computer forensics analysis with incident response yet it took it almost two weeks to detect an attack on its own systems.

Guidance cites the ongoing investigation into the attack as its reason for declining to discuss the implication of the attack. The assault on Guidance Software follows a whole bevy of internet security breaches involving major US corporations including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others over recent months. ®

alert Send corrections

Opinion

Lightning

Jack Clark

Just as Jeff Bezos did to books and CDs, Amazon's rivals are now doing to it
Microsoft CEO Satya Nadella
ARA_LIbertad

Chris Mellor

Elliott Management sinks its teeth into retiring godhead

Features

Failure to crack next-gen semiconductors threatens to set back humanity
SMEs get lip service - what they need is dinner at the Club
SAP Match Insights
Vorsprung durch grossendatatechnik, as we like to say in Germany
Inside the Google Lab where surgeons prepare the human/dog experiment
Big Blue exec tells El Reg what to keep an eye on