Compaq site exposes customer details
Elementary security mistake
Compaq has taken its customer tracking site offline today after the Register alerted it to a security issue that left sensitive customers details exposed on an insecure server.
The site, athome.compaq.com, was set up in a way that allowed anyone who fancied playing around with the order ID number in the URL to gain ready access to customer names, addresses, phone numbers and billing addresses. Credit card or bank details weren't exposed but Compaq has made an elementary security mistake.
Yesterday we reported how sports merchandise etailer Official-merchandise.co.uk exposed customers details in the same way as Compaq. The IT giant's security gaffe came to light after a Register reader informed us that it was using similarly lax security procedures.
To its credit when we informed it of the problem, Compaq acted promptly to acknowledge the issue and suspend access to the site while it bolsters its security. No other Compaq sites are affected by the problem, the firm told us.
Compaq expects to be able to restore access to athome.compaq.com later today. ®