Feeds

Hackers breach chocolate recipe on Hershey website

Possible data theft

Top 5 reasons to deploy VMware with Tegile

Hackers breached the security of a website operated by US confectionery giant Hershey Company and may have made off with customers' names, birthdates, street and email addresses, and site passwords.

In an email sent to customers last week, Hershey said an unauthorized individual accessed the site and changed a baking recipe for one of its products. The company said it found no evidence any other recipes on the website were affected, but it couldn't rule out the possibility that hackers stole personal data taken when customers create accounts on the site.

“We have no indication that any of this consumer information was compromised,” Hershey's email stated. “However, given the nature of this incident, we are acting out of an abundance of caution and informing you that this server was accessed. We are also outlining some steps to help you ensure your security whenever you use the Internet and email.”

Hershey joins a huge roster of other organizations that have suffered website security breaches that jeopardize the privacy of its visitors. Other companies recently compromised include Sony, Groupon India, email marketer Silverpop, gossip website Gawker, and at least a dozen others.

The rash of security lapses underscores the misplaced trust many people place in the websites they visit. More often than not, these sites have no good reason to store a user's birthdate and street address, and yet visitors dutifully surrender such information. The breaches also demonstrate the liability companies face when they later lose their customers' personally identifiable information, often as a result of easily preventable security vulnerabilities, such as SQL-injection holes and cross-site scripting bugs.

The Reg strongly recommends users withhold as many personal details as possible and use secondary email addresses that are reserved specifically for that website. ®

Internet Security Threat Report 2014

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.