Company Detected Years-Long Breach Only After Hacker Maxed Out Servers' Storage

What could be even worse than getting hacked?

It's the "failure to detect intrusions" that always results in huge losses to the organizations.

Utah-based technology company InfoTrax Systems is the latest example of such a security blunder, as the company was breached more than 20 times from May 2014 until March 2016.

What's ironic is that the company detected the breach only after it received an alert that its servers had reached maximum storage capacity due to a data archive file that the hacker created.

InfoTrax Systems is an American company based in Utah that provides backend operations systems to multi-level marketers, which also includes an extensive amount of sensitive data on their users' compensation, inventory, orders, and accounting.

The breach reportedly occurred in May 2014 when the hacker exploited vulnerabilities in InfoTrax's server and its client's website to gain remote control over its server, allowing him to gain access to sensitive personal information for 1 million consumers.

At the time, the United States Federal Trade Commission (FTC) sued the company for failing to safeguard the personal information the company maintained on behalf of its clients.

According to the FTC complaint, the hacker remotely accessed the system 17 times over the next 21 months without being detected and then began pulling the personal information of consumers on March 2, 2016.

The stolen information included customers' full names, social security numbers, physical addresses, email addresses, telephone numbers, usernames, and passwords for 4100 distributor and admin accounts on the InfoTrax service.

What's even worse? The leaked data also included some customers' payment card information (full or partial credit card and debit card numbers, CVVs, and expiration dates), as well as bank account information, including account and routing numbers.

The company discovered the breach on March 7, 2016, when it began receiving alerts that one of its servers had reached its maximum capacity, which was due to a massive data archive file that the hacker created on its customers.

Surprisingly, the intruder managed to breach the company at least two more times even after InfoTrax Systems became aware of the intrusion.

On March 14, 2016, the hacker harvested over 2300 unique, full payment card numbers—including names, physical addresses, CVVs, and expiration dates—and other billing data newly submitted by distributors during the checkout process.

Then again, on March 29, 2016, the hacker used the user ID and password of a valid InfoTrax distributor account to upload more malicious code to collect newly submitted payment card data from that client's website again.

According to the FTC, InfoTrax Systems failed to "inventory and delete personal information is no longer needed, conduct code review of its software and testing of its network, detect malicious file uploads, adequately segment its network, and implement cybersecurity safeguards to detect unusual activity on its network."

On Tuesday, the FTC published a press release, announcing a proposed settlement, which requires InfoTrax Systems to implement a comprehensive data security program that corrects the failures identified in the complaint.

Besides this, the proposed settlement also requires InfoTrax Systems to obtain third-party assessments of its information security program every two years.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.