[zeugma]

Just the latest in a string of security f**kups. Bank of America, Wachovia, LexisNexis, and more.

It may seem as though there has been a rash of these kinds of incidents. In fact, the main driver behind it all is a law in California that mandates disclosure of such incidents. 3 years ago, an incident like that mentioned in the article would have been kept quite quiet. Neither you nor I would ever have heard of it.

On a side note, while any computer system is vulnerable to a degree, IMO, placing that kind of information on a W2K system with IIS 5.0 that is internet facing should make them criminally liable for extreme damages. Note that they don't mention how long this breach has been occurring.

[Terpfen]

Agreed completely, if they weren't forced to disclose it, they wouldn't. And I know it's been going on for longer than we know about, which just annoys me even further. Good on California, though.

As an aside, what's your take on this?

[general_re]

On a side note, while any computer system is vulnerable to a degree, IMO, placing that kind of information on a W2K system with IIS 5.0 that is internet facing should make them criminally liable for extreme damages.

Their webserver is IIS on Win2k, which tells us nothing about the breach - I really, really doubt they had any of their payment systems running on their webserver, and nobody knows what they've got inside yet.