Barnesandnoble.com hit with fine for online security breach

Computerworld - Barnesandnoble.com Inc. has reached an agreement with New York Attorney General Eliot Spitzer to fix an Internet security breach that exposed the personal information of some of the online bookseller's customers, Spitzer's office announced yesterday.
Under the terms of the agreement, Barnesandnoble.com will pay $60,000 in costs and penalties and establish an information security program to protect personal information; establish management oversight and employee training programs; and hire an external auditor to monitor compliance with the security program.
"Consumers are concerned about how their personal information is secured and protected by online merchants," Spitzer said in a statement. "Our effort here should help assure that the terms of Barnes and Noble's Internet privacy policy are met."
The agreement follows an investigation into the company's privacy and information security practices.
During the investigation, Spitzer determined that a design vulnerability in Barnesandnoble.com's Web site permitted unauthorized access to consumers' accounts and personal information, and enabled users to make purchases on the site using other consumers' accounts, according to Ken Dreifach, chief of Spitzer's Internet bureau.
"The investigation began in 2002 when a number of good Samaritans notified us of the fact that they were able to inadvertently get into other consumers' accounts, order books or other items from another person's account and view that person's purchasing history," Dreifach said.
The vulnerability, which existed until August 2002, arose from Barnesandnoble.com's use of "cookieless" shopping. In order to avoid the use of cookies, Barnesandnoble.com stored certain user information in the URL, according to the statement. In certain situations -- such as a consumer forwarding or posting a Web page link -- the consumer information in the URL was inadvertently posted or forwarded to third parties.
Barnesandnoble.com CEO Marie Toulantis said the company cooperated with the investigation and fixed the problem very early on.
"No one's credit card was ever exposed," she said. "I can count on one hand the customer complaints about this."
Reuters contributed to this story.

Read more about spam, malware and vulnerabilities in Computerworld's Spam, Malware and Vulnerabilities Knowledge Center.