Barnesandnoble.com hit with fine for online security breach
Customers' personal data was exposed
Computerworld - Barnesandnoble.com Inc. has reached an agreement with New York Attorney General Eliot Spitzer to fix an Internet security breach that exposed the personal information of some of the online bookseller's customers, Spitzer's office announced yesterday.
Under the terms of the agreement, Barnesandnoble.com will pay $60,000 in costs and penalties and establish an information security program to protect personal information; establish management oversight and employee training programs; and hire an external auditor to monitor compliance with the security program.
"Consumers are concerned about how their personal information is secured and protected by online merchants," Spitzer said in a statement. "Our effort here should help assure that the terms of Barnes and Noble's Internet privacy policy are met."
The agreement follows an investigation into the company's privacy and information security practices.
During the investigation, Spitzer determined that a design vulnerability in Barnesandnoble.com's Web site permitted unauthorized access to consumers' accounts and personal information, and enabled users to make purchases on the site using other consumers' accounts, according to Ken Dreifach, chief of Spitzer's Internet bureau.
"The investigation began in 2002 when a number of good Samaritans notified us of the fact that they were able to inadvertently get into other consumers' accounts, order books or other items from another person's account and view that person's purchasing history," Dreifach said.
The vulnerability, which existed until August 2002, arose from Barnesandnoble.com's use of "cookieless" shopping. In order to avoid the use of cookies, Barnesandnoble.com stored certain user information in the URL, according to the statement. In certain situations -- such as a consumer forwarding or posting a Web page link -- the consumer information in the URL was inadvertently posted or forwarded to third parties.
Barnesandnoble.com CEO Marie Toulantis said the company cooperated with the investigation and fixed the problem very early on.
"No one's credit card was ever exposed," she said. "I can count on one hand the customer complaints about this."
Reuters contributed to this story.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.



- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Reducing the Cost and Complexity of Web Vulnerability Management
- Hackers and cybercriminals are constantly refining their attacks and targets; which means you need agile tools to stay ahead of them.
Download this... - Overcome Top 7 Admin Challenges of Active Directory
- As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable,...
- Insiders Can Ruin Your Company. Take Action.
- Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in...
- Top Solutions and Tools to Prevent Devastating Malware
- Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring...
- Streamline Compliance and Increase ROI
- Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will... All Malware and Vulnerabilities White Papers
- Optimizing Networks for the Cloud
- Join guest speaker, Rohit Mehra, IDC Director of Enterprise Communications Infrastructure, to explore current trends, discuss best practices for optimizing Data Center and...
- Apps QuickStart Series Part 2: Designing and Deploying SQL Server on VMware vSphere
- Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as...
- Apps QuickStart Series Part 1: Designing and Deploying Exchange 2010 on VMware vSphere
- Download this webcast to learn the virtual hardware design considerations for Exchange 2010, deployment using the building block approach, options for high-availability and...
- Customer Spotlight: How IPC The Hospitalist Company Implemented Oracle on VMware
- Have you been looking to hear about customer's experiences with the new VMware vCenter Site Recovery Manager product? View this webcast to learn...
- Virtualize Business-Critical Applications with Confidence
- Virtualizing business-critical applications has become a key focus for organizations as they move along their virtualization journey. With the launch of VMware vSphere®... All Malware and Vulnerabilities Webcasts