Babycare e-tailer Kiddicare admits customer data breach

I do like Kiddicare's logic.

They haven't stolen your payment information, but they may know where you live.

yet more dumbing down

"strongly encrypted passwords". I hope that they were strongly hashed (irreversible) rather then encrypted (reversible), but you need to use words that push-chair purchasers might recognise.

I messaged them myself a few weeks back too, as I received a dodgy sms from 'HMRevenue' asking me to click a link to process my tax refund. The site automatically filled in all the details, but had information specific to that which only Kiddicare had (I'd recently changed my name last year so registered just before November) so certain information which was automatically filled in to try and trick unsuspecting folk to thinking it was genuine was information I had only used on Kiddicare at the time. I did message them on Facebook regarding this, but they said (at the time) that there had been no security breaches & promptly deleted my post on their page.

Alas, I feel better now knowing where my details were most likely obtained from by the scammers!

I'm not angry or upset about this, these things happen! The size and complexity of websites now can mean any portion of it could be liable to some sort of exploit, or some backend deployment gone awry could also cause a brief moment where information could be accessed.

PCI Complaince

Just trying to work out how it works here. Vaguely remember when looking at setting up an ecommerce site for someone looking at payment options, e.g be a gateway to something like Verisign or actually retain CC data. I seem to remember the CC retention data requirements to be pretty strict including things like pen tests.

Now I have just looked on the PCI complaince site and looked at their different Merchant levels seems if you are low enough, under 1 million transactions you can self assess, or use a PCI approved ISP such as 1&1!.

So whats going wrong? Should all people retaining CC data, have to comply with the strictest standards? Are the higher level approved PCI pen testers, and ISPs not good enough?

I mean I know it happens and it's always an arms race but you see places that have this sort of data falling to outdated cracks. Why is this? Why are they being allowed to keep CC data?

I sent El Reg the email as soon as I read it.

There have been a few worrying scam emails doing the rounds with lots of personal information contained; and not just the fake HMR mentioned above; it is at least nice to know where it all came from, but shame on Kiddicare for taking so long to come clean.

Anon, as I dont want my Kiddicare account and this one linked; luckily I havent used their website in over a year, and the CC used has expired anyway.

For heaven's sake

Would someone think of the children.

Well, for once it's appropriate..

Kiddicare? What about Precious Little One? http://www.preciouslittleone.com/

I use a unique email per site for many sites. The preciouslittleone address which I only used in 2011 was first stolen by someone pretending to be Apple in May 2014, and then was used from January this year a total of 169 times. They know my name, address and phone number and can only have got them from PreciousLittleOne.

I've not heard a peep from PreciousLittleOne, but clearly they were hacked (seeing as it's only the address I used for them which has had this).

"We want to make you aware that Kiddicare has recently experienced unauthorised access to some customer details. The information accessed does NOT include any credit/debit card information or any payment details whatsoever. Kiddicare does not store any of this information on its systems."

I'm sure that stock announcement will make your customers feel a lot better.

"Customers of the site were notified of the snafu by email, a copy of which was forwarded to The Register (pdf). The firm has published an FAQ about the breach on its website but this was not immediately promoted through either its front page or social media accounts, omissions criticised by security watcher Graham Cluley."

They certainly wouldn't want to put off those potential new customers by declaring that they can't keep your details safe.