Channel Register

Original URL: http://www.channelregister.co.uk/2005/12/20/guidance_security_breach/

Computer forensics firm Guidance hacked

By John Leyden
Published Tuesday 20th December 2005 15:04 GMT

Computer forensics firm Guidance Software has itself become the subject of a hack attack, prompting warnings to its clients in law enforcement and computer security that their financial details may have been exposed.

In a letter sent out last week, Guidance warned its customers that a November attack on its databases might have exposed details of its approximately 3,800 credit cards. Guidance stored customer credit details on an unencrypted database along with card value verification (CVV) numbers, a violation of merchant guidelines issued by both Visa and Mastercard. The names, addresses and telephone numbers of clients were also exposed.

New York-based computer forensics firm Kessler International, a Guidance Software client whose payment details were exposed as a result of the breach, uncovered $20,000 in unauthorized charges on its AmEx account following the attack, the Washington Post reports (http://www.washingtonpost.com/wp-dyn/content/article/2005/12/19/AR2005121900928.html). The full scope of losses remains unclear. Guidance has called in the US Secret Service to help investigate the attack.

John Colbert, Guidance's chief exec, told the paper that it notified clients two days after uncovering the security breach. Following the attack, Guidance has decided to stop storing customer credit card details (a policy change that invites the question why it held those details in the first place, we'd note).

"This certainly highlights the fact that intrusions can happen to anybody and that nobody should be complacent about security," Colbert said. California-based Guidance Software was obliged to disclose the attack under the state's information security disclosure laws. News of the breach has prompted tough questions about why Guidance violated basic security guidelines on the processing of credit card details. The firm touts its ability of its EnCase software to merge computer forensics analysis with incident response yet it took it almost two weeks to detect an attack on its own systems.

Guidance cites the ongoing investigation into the attack as its reason for declining to discuss the implication of the attack. The assault on Guidance Software follows a whole bevy of internet security breaches involving major US corporations including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others over recent months. ®

© Copyright 2008