Computer Security Company hacked

From The Register

"Computer forensics firm Guidance Software has itself become the subject of a hack attack, prompting warnings to its clients in law enforcement and computer security that their financial details may have been exposed.

In a letter sent out last week, Guidance warned its customers that a November attack on its databases might have exposed details of its approximately 3,8background-color: #b7c3cf; -moz-border-radius: 10px; min-height: 20px; width: 575px; font-weight: normal; padding: 15px 15px 15px 15px;background-color: #b7c3cf; -moz-border-radius: 10px; min-height: 20px; width: 575px; font-weight: normal; padding: 15px 15px 15px 15px; credit cards. Guidance stored customer credit details on an unencrypted database along with card value verification (CVV) numbers, a violation of merchant guidelines issued by both Visa and Mastercard. The names, addresses and telephone numbers of clients were also exposed.

John Colbert, Guidance's chief exec, told the paper that it notified clients two days after uncovering the security breach. Following the attack, Guidance has decided to stop storing customer credit card details (a policy change that invites the question why it held those details in the first place, we'd note).

"This certainly highlights the fact that intrusions can happen to anybody and that nobody should be complacent about security," Colbert said. California-based Guidance Software was obliged to disclose the attack under the state's information security disclosure laws. News of the breach has prompted tough questions about why Guidance violated basic security guidelines on the processing of credit card details. The firm touts its ability of its EnCase software to merge computer forensics analysis with incident response yet it took it almost two weeks to detect an attack on its own systems.

Guidance cites the ongoing investigation into the attack as its reason for declining to discuss the implication of the attack. The assault on Guidance Software follows a whole bevy of internet security breaches involving major US corporations including data mining firm ChoicePoint, payment processing firm CardSystems Solutions and others over recent months. ®"