Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Virus and Vulnerability Roundup
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Barnesandnoble.com hit with fine for online security breach

Customers' personal data was exposed

April 30, 2004 12:00 PM ET

Computerworld - Barnesandnoble.com Inc. has reached an agreement with New York Attorney General Eliot Spitzer to fix an Internet security breach that exposed the personal information of some of the online bookseller's customers, Spitzer's office announced yesterday.
Under the terms of the agreement, Barnesandnoble.com will pay $60,000 in costs and penalties and establish an information security program to protect personal information; establish management oversight and employee training programs; and hire an external auditor to monitor compliance with the security program.
"Consumers are concerned about how their personal information is secured and protected by online merchants," Spitzer said in a statement. "Our effort here should help assure that the terms of Barnes and Noble's Internet privacy policy are met."
The agreement follows an investigation into the company's privacy and information security practices.
During the investigation, Spitzer determined that a design vulnerability in Barnesandnoble.com's Web site permitted unauthorized access to consumers' accounts and personal information, and enabled users to make purchases on the site using other consumers' accounts, according to Ken Dreifach, chief of Spitzer's Internet bureau.
"The investigation began in 2002 when a number of good Samaritans notified us of the fact that they were able to inadvertently get into other consumers' accounts, order books or other items from another person's account and view that person's purchasing history," Dreifach said.
The vulnerability, which existed until August 2002, arose from Barnesandnoble.com's use of "cookieless" shopping. In order to avoid the use of cookies, Barnesandnoble.com stored certain user information in the URL, according to the statement. In certain situations -- such as a consumer forwarding or posting a Web page link -- the consumer information in the URL was inadvertently posted or forwarded to third parties.
Barnesandnoble.com CEO Marie Toulantis said the company cooperated with the investigation and fixed the problem very early on.
"No one's credit card was ever exposed," she said. "I can count on one hand the customer complaints about this."
Reuters contributed to this story.



Jump to comments

Viruses

Additional Resources

WHITE PAPER
Approximately 60 percent of data migration projects overrun time or budget, while some fail completely. Download this white paper, "Enhancing Your Chance for Successful Data Migration," to learn the critical steps you need to take to execute a data migration project with minimum cost and risk to your business.
WHITE PAPER
Read the Gartner research note to learn why the TCO of a server-based computing deployment used to deliver all applications to users is around 50% lower than that of an unmanaged desktop deployment.
WHITE PAPER
Economic downturns have a tendency to accelerate emerging technologies, boost the adoption of effective solutions, and punish solutions that are not cost competitive or that are out of synch with industry trends. This IDC White Paper presents the results of an IDC survey of 330 companies in Western Europe, Asia/Pacific and the Americas that measures the receptiveness to Linux and takes into consideration changing views driven by the disruptive economic environment that businesses face today.