Feeds

WorldPay struggles under DDoS attack (again)

Systems safe but running at a crawl

  • alert
  • submit to reddit

SANS - Survey on application security programs

WorldPay, the Royal Bank of Scotland's internet payment transaction outfit, is continuing to fight a sustained internet attack which has left its services largely unavailable for a third successive day.

Since Saturday (2 October), WorldPay's online payment and administration system has been reduced to a crawl, due to a malicious DDoS attack by unidentified computer criminals. A spokesman for the company stressed that although is fighting a serious "denial-of-service" attack, its systems is uncompromised and customer data remains secure. "We are processing transactions securely but the attack is blocking our ability to operate normally. We apologise unreservedly for any inconvenience caused," he added. WorldPay's techies are working overtime to restore service but can't say when normal service will be restored.

In a notice to customers on Saturday (2 October), WorldPay said: "We regret that access to our payment and administration systems is severely disrupted due to a planned and large scale Denial of Service (DDOS) attack by a third party. Our payment and administration systems are working, safe and secure, but the networks around them are being flooded with requests on a huge scale, causing 'service denials'. We are processing payments, but far slower and fewer than we normally would.

"We are executing our contingency plans to move to full restoration of the service but cannot at this point in time predict when all customers will have the service restored without further interruption. While attacks of this type can be anticipated, it does take time to identify and deal with the exact nature of a particular attack. We are doing everything that is possible to restore a full service as soon as is possible," it added.

Users are advised to check WorldPay's customer service portal for updates. WorldPay was the subject of a similar three-day long denial of service attack last November.

One Reg reader writes: "Looks like they have not learned much from last year/s dos attack as the service has been down for most of the day. We have lost thousands in orders."

A WorldPay spokesman said the vast majority of customers had been supportive and understanding. He noted that many businesses had experienced DDoS attacks in recent months. Many of these attacks have been linked to extortion attempts, but WorldPay declines to say if it has received any demands from its attackers. ®

Related stories

UK banks launch anti-phishing website
US credit card firm fights DDoS attack
Feds bust DDoS 'Mafia'
DDoSers attack DoubleClick
Online extortionists target Cheltenham
WorldPay recovers from massive attack

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.