Robert Siciliano discusses a Hotels.com breach after a stolen laptop exposed data for 230,000 customers. He explains how payment information moves through systems, why passwords alone don't protect you, and why employees often ignore security policies. Monitor your credit statements closely.
Chapters
From NBC News, this is Today. The popular website Hotels.com is warning customers this morning they may be at risk for identity theft. They say an auditor's laptop computer has been stolen. It contained the personal information, including credit card numbers, of some 230,000 customers. Robert Siciliano is the chief executive of IDTheftSecurity.com, a firm that advises corporations on privacy issues. Robert, good morning to you. Thanks for joining us.
Good morning to you, thank you.
We're learning this theft took place in February. The auditor had this information on a computer, it was in a locked car, and it was stolen. They don't believe the laptop was the target of the theft, but let's go back to square one. When I give my credit card number on a website, I'm assuming it's not on a laptop sitting in some employee's personal car. How often is our information mishandled in that way?
Well, what happens is once it's entered into the website, it's stored on a server And then when it's processed, it's downloaded into the organization's desktops and networks, and then processed through a third-party payment process server.
Is the fact that this laptop is password protected, does that prevent someone from getting in there and getting that information?
Most laptops, desktops, the password itself can be compromised. And then simply just pulling the hard drive and extracting the data off the hard drive can compromise the data as well.
Then you have to assume that whoever took this knows what they have know that this is valuable to those who want to perpetrate identity theft. Is that a given that someone would figure that out and know where to sell this information?
Well, not necessarily, but nowadays with government requiring corporations to disclose these breaches, criminals more and more are realizing that the information that they have in hand is more valuable than the laptop itself.
Robert, I was making purchases on the internet as recently as last night, and many sites that you go to a lot, they give you the option of keeping your credit card on file on, you can easily charge something. Is that where you get in trouble? Would these be credit cards where people have said, "Yes, keep this on file for future purchases"?
It's actually unrelated. They're two different situations. If you're going to allow the web server to maintain your credit card information, it's like a cookie storing your information. That's different than the information being on the laptop itself. Either way, Your ultimate responsibility as a consumer, somebody who's been victimized, is simply to pay attention to your monthly statement, making sure that you reconcile your credit card statement within a 30 to 60 day period of time, and then refuting any unauthorized charges. If you do that within 60 days, you're going to be fine.
Yeah, and we should point out again that this laptop was stolen in February, we're now in June. I know you got one of those letters from Hotels.com, you're apparently a customer. Are you now going back looking at previous credit card statements? Should you be doing that?
I reconcile my credit card statement every single month. 30 days making sure that there aren't any unauthorized charges like everybody else should, and I haven't had any problems, so there's no need for me to look back.
Yeah, but Robert, back to my first question about an employee with a laptop in their car. Is there any way for, for we as consumers to know how a company, what their policies are in terms of guarding this information is?
Well, most corporations on their website, within their documentation, they have some type of privacy and security policy in place that they make available to the clients. Now, even though they have have that policy in place, that doesn't mean that the employees follow those protocols.
Robert Siciliano, good talking to you. Thanks so much for the information.
