Barnesandnoble.com hit with fine for online security breach

Customers' personal data was exposed

By Linda Rosencrance

April 30, 2004 12:00 PM ET

Computerworld - Barnesandnoble.com Inc. has reached an agreement with New York Attorney General Eliot Spitzer to fix an Internet security breach that exposed the personal information of some of the online bookseller's customers, Spitzer's office announced yesterday.
Under the terms of the agreement, Barnesandnoble.com will pay $60,000 in costs and penalties and establish an information security program to protect personal information; establish management oversight and employee training programs; and hire an external auditor to monitor compliance with the security program.
"Consumers are concerned about how their personal information is secured and protected by online merchants," Spitzer said in a statement. "Our effort here should help assure that the terms of Barnes and Noble's Internet privacy policy are met."
The agreement follows an investigation into the company's privacy and information security practices.
During the investigation, Spitzer determined that a design vulnerability in Barnesandnoble.com's Web site permitted unauthorized access to consumers' accounts and personal information, and enabled users to make purchases on the site using other consumers' accounts, according to Ken Dreifach, chief of Spitzer's Internet bureau.
"The investigation began in 2002 when a number of good Samaritans notified us of the fact that they were able to inadvertently get into other consumers' accounts, order books or other items from another person's account and view that person's purchasing history," Dreifach said.
The vulnerability, which existed until August 2002, arose from Barnesandnoble.com's use of "cookieless" shopping. In order to avoid the use of cookies, Barnesandnoble.com stored certain user information in the URL, according to the statement. In certain situations -- such as a consumer forwarding or posting a Web page link -- the consumer information in the URL was inadvertently posted or forwarded to third parties.
Barnesandnoble.com CEO Marie Toulantis said the company cooperated with the investigation and fixed the problem very early on.
"No one's credit card was ever exposed," she said. "I can count on one hand the customer complaints about this."
Reuters contributed to this story.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

POLL RESULTS

Leading IT Pros Weigh In on Top IT Issues

Accelerate your knowledge of the IT world you inhabit by viewing the results of a series of polls taken by your IT peers. These polls of 100+ IT professionals each are available for full viewing. They cover key topics such as virtualization, processor performance, green IT, cloud computing and many others. Be a part of the buzz.

WHITE PAPER

For Best Results, Think Beyond the Box

Technology is complex. Keeping it running productively shouldn't be. To that end, you want to minimize the number of solutions needed in-house to simplify operations, maintenance, and support. Kodak offers a best-practices model. One company provides support for both scanner and software, for fast problem resolution without vendor finger-pointing. Download now!

WHITE PAPER

Accelerating the Path to Demand Intelligence with a Demand Signal Repository

Utilizing demand intelligence improves the precision of pricing, product assortments, channel/store placement, and promotion, which are all essential for sustainable revenue management performance. Learn more, download this free whitepaper today.

White Papers & Webcasts

An All-in-One Approach to Web Security
Granting web access to employees poses challenges to IT administrators and introduces unique security risks. Even as companies have perfected their security techniques...

Usability Is Everything
Learn what sets Workday's HR and Payroll solutions apart from the competition....

The Hidden Dangers of Spam
Beyond the well-understood productivity drain that spam inflicts on businesses, threats posed by illicit email circulating through a network are causing many security...

The Value of Real SaaS at Workday
Cost savings, speed to value, and innovation brought to the enterprise by Workday's software-as-a-service solutions for HR and Payroll....

Employee Web Use and Misuse
(Source: MessageLabs - now part of Symantec) There is a balance between monitoring and blocking web use in the workplace. IT Managers need...

SaaS at Flextronics, Inc.
Dave Smoley, CIO of Flextronics, discusses the real value of software-as-a-service and why he chose Workday for his HR solution....

Get More from Your IT Budget
In uncertain economic times, it's critical to spend your budget wisely. Unlike software or hardware solutions, hosted email security is simple to implement,...

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

Email Security Buyer's Guide
Is your existing email security in need of review? Spam, viruses and other forms of malware pose a serious threat to your business....

Agile Enterprise Content Management (ECM) for Rapid ROI
Find out how combining ECM and BPM will help adress issues about content rich business processes....

All White Papers | All Webcasts