Feeds

Geeks.com settles charges claiming its security was crap

A decade in the stockade

Intelligent flash storage arrays

Geeks.com, a large online seller of computer hardware and software, has agreed to allow federal regulators to monitor its website security for 10 years to settle charges it violated federal laws requiring it to adequately safeguard sensitive customer data.

The agreement, which also applies to sister site computergeeks.com, settles a complaint filed by the Federal Trade Commission that accused the online retailers of misleading its customers about the safety of their personal information. Names, addresses, credit card numbers, and other data were routinely sent unencrypted to authorization services, making them ripe for identity thieves, the complaint alleged.

What's more, the sites carried privacy policies that claimed the company employed "secure technology, privacy protection controls and restrictions on employee access in order to safeguard your personal information."

During a six-month period starting in January of 2007, the sites were breached repeatedly by hackers who used simple SQL injections to siphon credit card numbers, expiration dates, and other sensitive details on hundreds of customers. Website operators didn't learn of the attacks until the following December. During the time of the breach, Geeks.com proudly displayed a banner provided by security provider McAfee claiming the site was "Hacker Safe".

The sites have since closed the security holes and notified law enforcement authorities.

Genica Corp., the websites' parent company, has agreed to submit its website security to outside auditing by qualified security professionals every other year and to make the results available to FTC officials. The agreement will remain in place for the next decade. The company also agreed not to make misleading claims about its website security.

Even with federal charges settled, Genica is likely to have some explaining to do with the credit card industry. Payment card industry regulations require merchants to follow a maze of procedures designed to protect card data as it's stored on servers and zapped to authorization services. Penalties for violations can be steep.

The FTC's complaint and settlement (both of them PDFs) are here, and here respectively. ®

Security for virtualized datacentres

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.