Why it matters to you
The scenario that led to this breach demonstrates the paramount importance of proper security practices when it comes to ecommerce.
In June 2016, Acer announced that a security breach pertaining to its online storefront serving North America had resulted in thousands of users’ personal data being compromised. Now, the New York attorney general’s office has confirmed that the company will pay $115,000 in penalties, following an in-depth investigation into the error.
It’s been discovered that an Acer employee enabled debugging mode on the company’s ecommerce platform between July 2015 and April 2016, according to a report from Engadget. This setting caused all personal data provided by customers via web forms to be saved to an unencrypted, plain-text log file.
The information offered up included full names, credit card numbers, expiration dates, verification numbers, user names and passwords for the site, email addresses, and full street addresses including ZIP codes. Customers would obviously need to submit this data to carry out a transaction on the website, but it’s easy to imagine how malicious entities could use it to commit acts of fraud.
More: Acer looks to appeal to the education market with its Chromebook Spin 11
Furthermore, there’s confirmation that the Acer website was misconfigured such that unauthorized users could browse its directory. Attackers could access subdirectories from a web browser, according to a release published by the attorney general’s office.
The investigation has found that 35,000 users based in the United States, Canada, and Puerto Rico had their information stolen as a result of the breach. At least one hacking group has been confirmed to have exploited the site’s vulnerabilities to obtain this data between November 2015 and April 2016.
As well as the $115,000 settlement, Acer will be required to enforce several new security policies intended to ensure that these mistakes aren’t repeated. The company will have to deliver yearly employee training about data security and customer privacy, and designate a specific employee to be notified whenever customer data is stored without encryption, among a list of other stipulations.