Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards used on cvsphoto.com may have been compromised

cvsphoto.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Credit cards used on cvsphoto.com may have been compromised

#11

Post by akerl_ »

mahouse wrote: post #6
akerl_ wrote: post #2

For those not looking to click through to the site: ==== We have been made aware that customer credit card information collected by the independent vendor who manages and hosts CVSPhoto.com may have been compromised. As a precaution, as our investigation is underway, we are temporarily shutting down access to online and related mobile photo services. We apologize for the inconvenience and are working diligently to re…

Thank you, this is a very valuable and useful comment.

My sarcasm detector is admittedly permanently broken thanks to years on IRC and forums, but just in case:

It's useful because the steps a reader would need to take before being secure clicking through to a site identified in the submission title as "hacked" (I notice the title has been clarified since then) are non-trivial. I figured since I'd done them once, I might as well save additional folks the steps if they were just looking for the page contents.

Re: Credit cards used on cvsphoto.com may have been compromised

#12

Post by chockablock »

kejaed wrote: post #8

Like others have said about this happening to Costco too, this is all because CVS, Costco, Sam’s Club, Walmart Canada, and Rite Aid use PNI Media as a backend for their photo services and PNI seems to have been hacked: http://krebsonsecurity.com/2015/07/cvs-probes-card-breach-at...

This article should replace the current article link (to cvsphoto.com)

Re: Credit cards used on cvsphoto.com may have been compromised

#13

Post by klinskyc »

TobbenTM wrote: post #7

My plugin made it even worse: http://i.imgur.com/uSnzzHC.png

Hey, I'm actually the creator of the plugin. I'm amazed to see a picture of it on HN. Thanks for using it and let me know if you have any questions. If anyone else wants to use it, it's called Plain Text Offenders Alert and available in the chrome web store.

Re: Credit cards used on cvsphoto.com may have been compromised

#14

Post by vermontdevil »

noenzyme wrote: post #5

Same thing happened to Costco a few weeks ago. Maybe the same company behind both. From http://www.costcophotocenter.com/ === As a result of recent reports suggesting that there may have been a security compromise of the third party vendor that hosts Costcophotocenter.com, we are temporarily suspending access to the site. We take the security of our members’ data seriously, which is why we are taking this precautiona…

Hate when they say "We take security of our members' data seriously".

How do I know the hack was due to their incompetence? PR people need to come up with a better approach.

Re: Credit cards used on cvsphoto.com may have been compromised

#15

Post by dexterdog »

chockablock wrote: post #10

Was access to stored photos also compromised? The linked message from CVS doesn't say one way or the other.

From the page: "We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored."

That being said, my understanding as somebody with 15 years of working history in the online photo space is that PNI is the host and all of their major customers shut off so I can't imagine that PNI is very healthy right now. If I am mistaken and the individual sites (Rite Aid, Costco, Sam's Club, Tesco, CVS and Walmart Canada) actually store and manage the photos then the data is likely to be fine.

That also being said, never trust your photo storage to an online service even if you are paying for it. Photos generally don't take up that much space. You should have at least two copies on devices that you own if you don't want to lose them.

Re: Credit cards used on cvsphoto.com may have been compromised

#16

Post by pavel_lishin »

dexterdog wrote: post #15
chockablock wrote: post #10

Was access to stored photos also compromised? The linked message from CVS doesn't say one way or the other.

From the page: "We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored." That being said, my understanding as somebody with 15 years of working history in the online photo space is that PNI is the host and all of their major customers shut off so I can't imagine that PNI is ver…

Having two hard drives with my photos on them doesn't protect me against a house fire.

Re: Credit cards used on cvsphoto.com may have been compromised

#17

Post by sbarre »

pavel_lishin wrote: post #16
dexterdog wrote: post #15

Earlier quoted context omitted.

From the page: "We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored." That being said, my understanding as somebody with 15 years of working history in the online photo space is that PNI is the host and all of their major customers shut off so I can't imagine that PNI is ver…

Having two hard drives with my photos on them doesn't protect me against a house fire.

If your house burns down and your lost digital photos are your primary concern, you're probably doing ok.

I think he meant in addition to online storage.

Re: Credit cards used on cvsphoto.com may have been compromised

#18

Post by ectoplasm »

pavel_lishin wrote: post #16
dexterdog wrote: post #15

Earlier quoted context omitted.

From the page: "We apologize for the inconvenience and are working diligently to resume service as soon as possible. Your images are saved and you will have access to them once service to CVSPhoto.com is restored." That being said, my understanding as somebody with 15 years of working history in the online photo space is that PNI is the host and all of their major customers shut off so I can't imagine that PNI is ver…

Having two hard drives with my photos on them doesn't protect me against a house fire.

It does if one of them is in a safety deposit box.

Re: Credit cards used on cvsphoto.com may have been compromised

#19

Post by wglb »

vermontdevil wrote: post #14
noenzyme wrote: post #5

Same thing happened to Costco a few weeks ago. Maybe the same company behind both. From http://www.costcophotocenter.com/ === As a result of recent reports suggesting that there may have been a security compromise of the third party vendor that hosts Costcophotocenter.com, we are temporarily suspending access to the site. We take the security of our members’ data seriously, which is why we are taking this precautiona…

Hate when they say "We take security of our members' data seriously". How do I know the hack was due to their incompetence? PR people need to come up with a better approach.

I do as well. Check out https://news.ycombinator.com/item?id=9834099

Re: Credit cards used on cvsphoto.com may have been compromised

#20

Post by carbocation »

klinskyc wrote: post #13
TobbenTM wrote: post #7

My plugin made it even worse: http://i.imgur.com/uSnzzHC.png

Hey, I'm actually the creator of the plugin. I'm amazed to see a picture of it on HN. Thanks for using it and let me know if you have any questions. If anyone else wants to use it, it's called Plain Text Offenders Alert and available in the chrome web store.

Great plugin. Link here: https://chrome.google.com/webstore/detail/plain-text-offende...
Post reply on HN