Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about fraudulent credit card charges on our site and others. This leads me to believe that someone was able to get a list of our credit card numbers. What doesn't make sense is that we don't store that information and we use Authorize.net for the transaction. If someone was able to get the CC#s, what should I do next? Inform ALL of our customers that someone broken into our system and stole their information? I have a feeling that will be bad for business.

share|improve this question
5  
Are you sure someone wasnt just using stolen credit cards at your store? Thats pretty common. If you dont store the credit card number... how do you think someone got them? Are you sure you arent storing them someplace... in session information, for example? –  GrandmasterB Feb 9 '11 at 20:30
    
@GrandmasterB if I had to guess they read grabbed the database logs and executed attacks that way, at least that is what I would do if other routes failed. –  Woot4Moo Feb 9 '11 at 20:32

4 Answers 4

It could shut your business down.

If you do not store the card details, then identify how there could be a leak - quickly.

[I believe they are allowed to fine you upto $100,000 per incident if you fail to notify within 24 hours of discovery.]

If you find a leak, then do not notify customers, notify the credit card companies, they require you to do this and failure to do so can land you in very hot water in deed. Expect to be required to be audited at a minimum, you could be heavily fined as a company.

share|improve this answer

If you are certain that the card numbers have been leaked, no matter who is at fault, it would be in your best interest to inform everyone affected (The appropriate law officials and credit card companies too). Giving them advance warning now will look better than them getting ripped off by some thief and then finding out how their card number got stolen.

share|improve this answer

Document everything you've discovered about this breach. Back up the necessary files. Inform your management and get the FBI involved -- if you believe there has been a theft of cc#s.

Good luck!

KM

share|improve this answer

Well first and foremost if they captured the CC#'s you are in more trouble than you could ever imagine as that is against the law, at least in the US (apologies if you are not in the US). Authorize.net isn't really on the hook here as it was the poor coding of your web application, that being said what does the contract with Authorize.net state? Ideally there is no liability on your side and they take full responsibility. Worst case is you have to bite the bullet and risk law suits.

share|improve this answer
3  
We have an onsite lawyer. I just started here a week ago to do some basic website upgrades and then I started to notice all kinds of crazy things happening. Spam bots and SQL injection vulnerabilities. Now this... I don't know who wrote the original code. I believe it is an e-commerce CMS. –  user16566 Feb 9 '11 at 20:53
    
Regardless of the individual country law, the credit card handling will go through VISA/Mastercard most likely and they will fine/sue the pants off the company for losses. If they are really unable to get money via the law in a given jurisdiction (not common), then they would simply ban the company from accepting any more credit card transactions - which is not much better than being shut down in this age. –  Orbling Feb 10 '11 at 2:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.