Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

Post reply on HN
Print view View original

141–150 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#141

Post by jjav »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

> bozos in charge who can't seem to develop a secure payment system

Actually, the credit card system is very secure to you the consumer.

By regulation, you're not liable for anything if your card number is abused in a card not present transaction (typically the case here for numbers stolen over the internet).

I don't have any other form of payment that is as secure, so good job credit cards.

(As a cryptography and security nerd, it took me a long time to learn that while mathematically guaranteed security is very cool, sometimes you can achieve an equal result just by passing a law.)

Re: Delta Dental says data breach exposed info of 7M people

#142

Post by anonuser123456 »

purpleblue wrote: post #110

Delta Dental is one of the worst dental insurance companies out there. I hope it goes bankrupt. They have cut benefits so much that most dentists I know have dropped them completely and refuse to take them. It has caused a bunch of headaches for us and for most families I know.

My wife’s dentist dropped them this year. My dentist is considering it in the near future.

Re: Delta Dental says data breach exposed info of 7M people

#143

Post by jjav »

skibbityboop wrote: post #133
13of40 wrote: post #81

Earlier quoted context omitted.

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you…

> If you have a whole database of them, the trick is to try one code with a thousand cards That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.

Of course there is no guarantee, but statistically if you have 1/1000 probability of success and you try a 1000 times, that's not bad.

Re: Delta Dental says data breach exposed info of 7M people

#144

Post by __derek__ »

gowld wrote: post #101
__derek__ wrote: post #60

Earlier quoted context omitted.

The title is borderline click-bait: I have had Delta Dental insurance at every employer, so I clicked through to read more, but I've never lived in California or been employed by a California company.

Did the title say your info was leaked?

My info was not leaked because I've never done business with Delta Dental of California. The title omits the essential "of California" context.

Re: Delta Dental says data breach exposed info of 7M people

#146

Post by dreamcompiler »

We need regulations that fine companies in the neighborhood of $10,000 per violation (i.e. per person whose info was compromised) plus potential prison time for company officers in cases of egregious violations, which this appears to be.

Until prison time is on the table, companies will continue to collect, store, and sell personal information and will continue to fail to implement best practices for protecting it.

Re: Delta Dental says data breach exposed info of 7M people

#147

Post by [deleted] »

wombatpm wrote: post #88
bee_rider wrote: post #77

Earlier quoted context omitted.

In 2002? Probably something now-crazy like “how else will I process returns?” It is not directly related, but as a hopefully funny semi-related anecdote, the federal government stopped states from putting social security numbers on drivers licenses in 2004. Renewals frequency depends on the state, but it is typically in the 4-8 year range, so plausibly until 2012 people were going around showing their SSN to anybody…

At one time it was routine to have your SSN and Drivers License # printed on your checks. And in 1988 my student ID number as university was my SSN.

[deleted]

Re: Delta Dental says data breach exposed info of 7M people

#148

Post by andrei_says_ »

calfuris wrote: post #103
andrei_says_ wrote: post #96

Earlier quoted context omitted.

I use delta dental. What does this mean? Why would they store my CC info when I’m paying directly to my dentist and delta dental is also paying the dentist? How does my CC info get transferred to the insurer? There’s no such transaction afaik.

How are you paying your premium? For individual plans, I suspect that a lot of people use a card.

Employer.

Re: Delta Dental says data breach exposed info of 7M people

#149

Post by phatskat »

fatnoah wrote: post #6
mikece wrote: post #2

At this point I'm willing to bet that every single American -- including the Amish -- have been part of at least one major data breach. And for everyone on HN... probably at least ten.

I've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the data included was literally everything, since it was everything collected as part of my application for a security clearance. A result of that was 10 years of credit monitoring, so every new breach's offer of 12 or 24 months of monitoring is useless. Until there…

> statutory damages for data breaches, and even steeper ones for failure to report breaches

If say an engineer becomes aware of a breech, would going public if their company didn’t do so within the legal timeframes to report be covered by whistleblower protections?

Re: Delta Dental says data breach exposed info of 7M people

#150

Post by mikegabriel »

Under PCI-DSS v4.0, the card verification code, which is the three- or four-digit number printed on the front or back of a payment card, must not be retained after the completion of the authorization process. This rule is in place to prevent fraudulent activities, such as Internet and mail-order/telephone-order transactions, which can occur if card verification code data is stolen .
Post reply on HN