IBill Loses 17million Records

On of Webs Largest Credit Card Procession Houses

[Brett_Tabke]

Possibly the most significant - and embarassing to some - security leak in the history of the internet.

[wired.com...]

Seventeen million customers of the online payment service iBill have had their personal information released onto the internet, where it's been bought and sold in a black market made up of fraud artists and spammers, security experts say.

The stolen data, examined by Wired News, includes names, phone numbers, addresses, e-mail addresses and internet IP addresses. Other fields in the compromised databases appear to be logins and passwords, credit-card types and purchase amounts, but credit-card numbers are not included.

The transactions documented in the database are dated between 1998 and 2003, spanning a period at the height of iBill's success.

[Kufu]

Yes, please let me save my files on GDrive.

Soon, another leak will top this one.

[walkman]

great! Just searched my computer and turns out that I used ibill in 2004!

On edit: I seem to be safe: "The transactions documented in the database are dated between 1998 and 2003"

[minnapple]

Now downloading 17 million records . . . . . . . .
You would think someone interally would caught such a thing, no matter how it was done.

Now downloading 18 million records . . . . .
Smells like an inside job to me.

[vik_c]

I used ibill as a merchant long back. Then they increased their rates to ridiculous levels. So we moved.

[carguy84]

Anyone have a torrent link?

;)

[jonathanleger]

You would think someone interally would caught such a thing, no matter how it was done.

Clearly you've never worked in the IT department of a large corporation. They are pretty clueless when it comes to what's going on just about anywhere. :)

As a software developer, I could have easily burned enormous amounts of private information on customers (individuals and businesses, addresses, CC numbers, billing information, etc. etc.--very private stuff) to CD and sold it off to the highest bidder and the company would never know a thing because, as I said, management is clueless.

[iThink]

This list has been on sale since 2004 on a number of boards. So Wired.com is around 2 years late in reporting this.

[oddsod]

Yes, please let me save my files on GDrive.

Ah, but as you probably know, Google is infallible and unlikely to ever let such a security lapse occur.

[incrediBILL]

Before the flood of sticky's come, I've lost NOTHING, it's the other iBill.

[Robert Charlton]

I could have easily burned enormous amounts of private information on customers (individuals and businesses, addresses, CC numbers, billing information, etc. etc.--very private stuff) to CD and sold it off to the highest bidder and the company would never know a thing because, as I said, management is clueless.

Anyone who watches "24" should get this. ;)

[Essex_boy]

Oh boy, just what are the implications of this for first time buyers in the ecommerce world?

I think Ill visit that nice nice store on the high street.

[goingincircles]

Pretty serious issue, but I did enjoy this paragraph:-

Contacted by Wired News, one of the victims of the breach expressed dismay that his information was in the hands of criminals. The 41-year-old San Diego man says he allowed a "business partner" to use his credit card on an adult website dedicated to finding resources in Tijuana's red light district, with discussion groups and locations of prostitutes.

Out of 17 million records, the one person they contacted had lent his credit card to someone else, he hadn't used porn himself.

What are the odds? :-D

[dudibob]

haha, that's funny

it's true, sounds very strange how they didn't realise how someone downloaded millions of files...

[gab55]

A friend told me to search for this "Ibill_1m.txt" and on about half of google DC's it return a site..

Server now had no response.. lol

[donpps]

"Todd Dugas, a former inside sales representative for iBill, estimates that pornography made up 85 percent of the business."

Yikes... time to check those .. bank statements eh? ;)

[PanUK]

great! Just searched my computer and turns out that I used ibill in 2004!
On edit: I seem to be safe: "The transactions documented in the database are dated between 1998 and 2003"

They don't release that data until next year. :)

[johncory]

Yes, please let me save my files on GDrive.

Soon, another leak will top this one.

It's ok, all your sensitive data is already labeled, archived and easily retrieved through Gmail. ;)

[Essex_boy]

Oh right so Ibill are adult content only then! Wont affect me then thank god. (no honestly)

[radix]

This loss of records is really bad news for me as a site owner who used iBill as payment processor in the past, up until Visa's IPSP rules came out. I belong to the est. 15% not in the adult industry with due respect to my subscribers.

If you are a site owner in a similar situation: do you plan any action to relay the news to your customers? Should I send an email to each of them apologizing? Or should I just ignore it?

Thanks!

[incrediBILL]

I wouldn't say squat to your customers, you weren't to blame so don't assume any liability whatsoever. It's the responsibility of iBill to address them, not you, as their security was breached, not yours.

[bnrowdy]

IncrediBill is right...if users approach you then communicate with them on a case by case basis but make sure you don't point the finger at yourself by offering an "apology" you shouldn't make.

[incrediBILL]

Dicussed it with my wife who makes a lot of online purchases and she agreed with me that 3 months later she might remember your company sending the email but not remember anything about iBill.

It could taint repeat business for sure.

[mcavic]

Google is infallible and unlikely to ever let such a security lapse occur

Infallible, no. But I think Google is quite a bit smarter than the average company.

[treeline]

That's why they "accidentally" posted a presentation online that wasn't supposed to be public, on how we should all trust them with our data storage.

[walkman]

>> Infallible, no. But I think Google is quite a bit smarter than the average company.

Plenty of smart companies have fallen victim to hackers. There's always somebody smarter than you...

[andrea99]

I suppose this is a good argument for periodically closing all your accounts and opening new ones. That would be smart. If you made a routine of it you could cope fairly well.

Actually collecting new credit cards is easy, they're constantly pushing them. Maybe throw away accounts is the way to go, just close out accounts when you get a new card.

[oddsod]

I suppose this is a good argument for periodically closing all your accounts and opening new ones.

That's emminently sound advice!

[incrediBILL]

Actually, the best advice I can give is that if you have multiple cards just use ONE for online purchases only, preferrably the one with the lowest credit line, then you can easily tell when you're being abused and you don't have to worry about cancelling all your cards.

Another trick you can play is get a Visa/MC debit card for a stand alone bank account and only transfer funds to that account to cover actual purchases. If you suddenly get nailed there's no money there to take and the damage is very limited.