Time Warner Cable says up to 320,000 customers' data may have been stolen
reuters.com
reuters.com
We hold the details of over 100M consumers, many of them children. This comprises stuff like their login, order history, etc. We take this shit seriously, keep what's needed only, pentest daily, ids, wargames, strict infosec policy - and when clowns like TW manage shit like this we all get tarred with the same brush.
Since the talk-talk hack we have had clients panicking at least twice a week over shit they read in the Newspapers.
Black Friday when all the ecommerce sites melt is similar - mass panic, at us - even though we've had 100% uptime since may last, and five nines over the year - and have never had any breach of any variety.
There should be steep criminal penalties in place for the officers of a company who allow this to happen. Jail. Business-ending fines.
The general public has no concept of what a ‘public key’ is.
1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial data.
3. That vendor's code and hardware infrastructure is being periodically audited by a third (independent ) party and expert. Or open sourced! Both hardware and software.
3 is crucial to maintain the operating integrity of the company.
My Twitter bot, @dumpmon, comes across thousands of leaked creds per day, and that's only on pastebin.
This, combined with "checker" services that can verify credentials to services like TWC make things like leaked credentials be correlated into "from these x unique dumps, we have a group of creds that all work with TWC as well".
My guess is that TWC was alerted to a file someone was trying to sell that took leaks from other public/private dumps or malware infections, checked them against TWC, and verified that they all happened to work. This would be why TWC wouldn't be able to pin down an exact source - there absolutely doesn't have to be just one source.
It happens more than you think.
At this rate, smart users won't re-use passwords, and 2FA should be mandatory everywhere.
Fucking morons deserve jail time.
http://www.webpronews.com/time-warner-cables-new-ad-strategy...
If the data was stolen through malware then this isn't TWC's fault. People just need more education on how to secure their computers.
There were only a few other payments on the card - NYTimes, DigitalOcean. Are there any recent breaches at those companies?
Either way, your privacy is dead, unless you can find a way to not have your home address on your account. I use a UPS box for everything... Except home utilities and Internet / cable.
Your utility companies have yours as well.
The article just states it, and when a company does that I assume they are just full of hot air.
If you have a better primary source I would be interested in seeing what form the breach was in, because I assume that would make it a lot more clear what the scope of the problem is.
"In a statement provided to NBC News, the cable giant said "there are no indications that TWC's systems were breached," and suggested the mails may have been acquired earlier by other means, such as malware, phishing attacks on subscribers or security breaches at companies that stored TWC customer information."
So seems like it was just phishing and malware to the unlucky ones.
I expect upping the sentence for accessing an "unauthorized system" to a top-level 40-year felony and everyone congratulating each other with a "well that should take care of it!" job well done.
Probably in the same bill, I would expect amnesty for management in exchange for whistleblowing on software engineers that did not follow "best practices".
And finally, perhaps some pamphlets with "tips" to "teach the public" what they can do to better protect their privacy ... none of which will involve not giving your information to large corporations.