Credit card details were stolen from a hotel booking website using the decryption key stored with customer data. The UK Information Commissioner's Office has fined Worldview Limited €9,560 for storing the decryption key with the data , allowing attackers to gain access to sensitive information on 3,814 customers. Full card details and security codes were among the items in the database.
Hackers exploited a vulnerability in the company's website and gained access to the database via SQL injection. The ICO (Information Commissioner's Office) has called on organisations to take immediate action to protect their websites "against one of the most common forms of cyberattack - SQL injection. "With the decryption key that stores encrypted information and using one of the most basic forms of attack, the attackers had no problem accessing the full card details.
According to a report by the ICO, the security code (CVV or CVV2) is a series of numbers required for online payments, as a means of validating that the physical card is available and also exists in the database. Best practices promoted by the card industry recommend that merchants do not store the CVV or CVV2 on their systems. Storing the code is generally done for the convenience of recurring shoppers (customers who shop again) so that they do not have to enter all the card details. However, in the event that their online account is compromised, the attacker can start shopping as if they were the real owner of the account.
SQL injection is one of the simplest forms of attack
The ICO says the SQL injection vulnerability existed on Worldview Limited’s website since May 2010 and was discovered on June 28, 2013, during an audit. It appears that the attackers had access to sensitive data for a period of ten days. Worldview Limited has fixed the issue on its website and is taking all necessary steps to prevent similar incidents in the future. “It may sound strange to many in the security industry that this type of attack is still being implemented. SQL injection attacks can be prevented, provided that organisations take the necessary time to ensure their website is secure. Worldview failed to do this, resulting in the credit card details of 3000+ customers being compromised,” said Simon Rice, ICO Group Manager.
