Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

Post reply on HN
Print view View original

111–120 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#111

Post by accrual »

calfuris wrote: post #103
andrei_says_ wrote: post #96

Earlier quoted context omitted.

I use delta dental. What does this mean? Why would they store my CC info when I’m paying directly to my dentist and delta dental is also paying the dentist? How does my CC info get transferred to the insurer? There’s no such transaction afaik.

How are you paying your premium? For individual plans, I suspect that a lot of people use a card.

At least at my $dayjob, premiums are deducted before I get my check, along with taxes, retirement, etc.

Like you mentioned, it's probably different for those who purchase their own insurance.

Re: Delta Dental says data breach exposed info of 7M people

#113

Post by wintogreen74 »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

it's not supposed to be a secret in the "something you know" way, but rather "something you have" - i.e. the physical card. If they store it you no longer need the physical card for an entire family of attacks & frauds.

Re: Delta Dental says data breach exposed info of 7M people

#114

Post by mrweasel »

Kalium wrote: post #107
mrweasel wrote: post #72

Earlier quoted context omitted.

I was going to ask something similar. Especially US companies seems rather fond of storing credit card information, but I never seem it done in Denmark, regardless of the size of the company. The most common solution is to let your payment processor deal with those sorts of things, you just have a token, which can only be used to deposit money into your account. So even if it's stolen or leaked, you can transfer the…

For a long time, payment processors in the US would charge more to offer tokenization services. Cost-conscious companies with an eye on their unit economics reacted in predictable ways.

> Cost-conscious companies with an eye on their unit economics reacted in predictable ways.

That seems like the likely explanation. I don't know what the additional cost would be, but with 7 million customers, it could be a million dollars a year in saving. That would require you to be able to be PCI compliant for less than that amount and the risk is still considerable, you could lose your VISA or MasterCard contract pretty quickly and then you're out of business.

We had a situation where scammers would use our site to check stolen credit cards, we got at most 7 days to handle the problem or VISA would close our account. I'd imagine that failing out of compliance would hit equally hard.

Re: Delta Dental says data breach exposed info of 7M people

#115

Post by 8n4vidtmkvmk »

13of40 wrote: post #81
chefandy wrote: post #34

Earlier quoted context omitted.

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k. If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authe…

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you…

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

Re: Delta Dental says data breach exposed info of 7M people

#117

Post by hedora »

People say that delta shouldn’t have been storing CVC numbers (fair point), but note that the breach was upstream of them at MoveIT, which supplies an on-prem file transfer program and cloud offerings specifically for managing PCI environments.

The real WTF is that the PCI compliance vendor’s solution led to them storing that data.

“It’s your only job,” and all that…

Re: Delta Dental says data breach exposed info of 7M people

#118

Post by 8n4vidtmkvmk »

sokoloff wrote: post #38
pants2 wrote: post #32

Earlier quoted context omitted.

The real question is why online credit card payments still involve using the whole card number, as opposed to some message signed by the card's private key authorizing certain spending limits for a retailer.

Online retailers almost surely do better by allowing easy use of credit cards by even the least technical 5% of Americans than they would from a lower fraud system that required a moderate or higher level of technical acumen to operate. Suppose I'm at a computer ready to buy a PS5 on BestBuy's site. What's the complexity now vs under a proposed private-key system? What's the loss in conversion rate on the latter?

Then offer both until the general public learns. The savvy can use the more secure system and the rest can upgrade when they're feeling brave.

Re: Delta Dental says data breach exposed info of 7M people

#119

Post by ahi »

bee_rider wrote: post #77
Sohcahtoa82 wrote: post #58

Earlier quoted context omitted.

> A customer asked for a screen to be able to see CC numbers for their own customers I'd be curious what reason they had.

In 2002? Probably something now-crazy like “how else will I process returns?” It is not directly related, but as a hopefully funny semi-related anecdote, the federal government stopped states from putting social security numbers on drivers licenses in 2004. Renewals frequency depends on the state, but it is typically in the 4-8 year range, so plausibly until 2012 people were going around showing their SSN to anybody…

Well into the 2000s it was routine to find unredacted SSNs in public Federal bankruptcy filings. Likewise, the old Congressional Records contain thousands of SSNs of newly promoted military officers. Librarians have spent a lot of time tracking these down in their archives to redact them.

Re: Delta Dental says data breach exposed info of 7M people

#120

Post by CWuestefeld »

andrei_says_ wrote: post #96
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

I use delta dental. What does this mean? Why would they store my CC info when I’m paying directly to my dentist and delta dental is also paying the dentist? How does my CC info get transferred to the insurer? There’s no such transaction afaik.

the OP says "Delta Dental of California", for one thing. I imagine that means that I'm safe.

California is not the entire world, believe it or not.

Post reply on HN