« Reply #2 on: March 22, 2011, 11:18:14 AM »
from the Grauniad
The online retailer Play.com is warning its customers their names and email addresses may have been stolen from a company that handles its marketing.
However the company suggests in its message, sent out to everyone who has done business with the site, that credit card details held at its main site have not been affected.
In an email to customers, the company said the issue "occurred outside of Play.com and no other personal customer information has been involved".
Play.com is the second largest online gadget and games retailer to the UK from its Jersey base, competing with Amazon for customers. Founded in 1998, it has about 7 million registered customers.
The breach could though put people at risk of "phishing" in which they receive fake emails pretending to be from Play.com which ask them to "confirm their details" and link them to a website which masquerades as the retailer's and asks for information such as passwords or credit cards. Play.com says in its warning that [in emails] "we will never ask you for information such as passwords, bank account details or credit card numbers. If you receive anything suspicious in your email, please do not click on any links and forward the email to privacy@play.com for us to investigate."
One customer, Luke Taylor, warned the Guardian on Monday that he suspected a breach after receiving spam email to an address that he only provided to Play.com. "They said that they had already heard of this and anyone who contacted them would have their information passed to the IT department who were investigating, and would be contacted in due course. They repeated this statement ad nauseam when I inquired why I hadn't been proactively contacted since they store sensitive data including credit card numbers. They wouldn't let me speak to anyone else."
A discussion in the forums on Moneysavingexpert.com uncovered more evidence the breach may have occurred over the weekend.
Other customers complained that Play.com has not provided enough information for them to act on – such as the date on which the breach is known to have occurred. The first spams to the unique emails used by some people for the site seem to have started on Sunday, implying that the hack occurred over the weekend.
A further complaint is that it is not possible to delete credit card details from Play.com's site, even on request – which means that if its payment database were breached then it could expose many thousands of people's details to criminals.
However Play.com has responded to customers who have expressed concern about credit card details or passwords for transactions on the site by saying that "our database is maintained on a secure internal server that is not connected to the internet".
Database breaches of online sites are a continuing problem which can be extremely costly. In January the cosmetics company Lush was hacked, and credit card details for anyone who shopped there between October and January were stolen.
Play.com is insistent that it is a third-party company which sends out marketing emails which has been hacked, and not its own servers.
Play.com had not returned a request for comment at the time of publication.
apparently the third party that was hacked DOESNT have CC details, but did store usernames AND passwords in plain text in a database.
Logged
"Banking was conceived in iniquity and was born in sin. The bankers own the earth. Take it away from them, but leave them the power to create money, and with the flick of the pen they will create enough deposits to buy it back again. However, take away from them the power to create money and all the great fortunes like mine will disappear and they ought to disappear, for this would be a happier and better world to live in. But, if you wish to remain the slaves of bankers and pay the cost of your own slavery, let them continue to create money." Josiah Stamp (Governor Bank of England 1928-41)
