News for hackers. Stuff that matters.

A comment on Someone just lost 324k payment records, complete with CVVs.

Re:Someone just lost 324k payment records, complete with CVVs by admiralhack_ on Tuesday September 13, 2016 @04:37PM (#12491998)
The author doesn't explicitly mention it, but the CVVs were saved as a part of debug logging. That mistake should serve as a warning to others implementing PCI DSS systems.
[ Parent | on HN ]
Re:Someone just lost 324k payment records, complete with CVVs by karmajunkie on Saturday September 17, 2016 @09:33AM (#12520413)
Where do you have that information from? I've seen the theory in the comments on troy's website, but no confirmation of it. My kid's after school program got hit and I'm working with them to translate Regpack's obfuscation of what went on and ask some pointed questions.
[ Parent | on HN ]
Re:Someone just lost 324k payment records, complete with CVVs by segmondy on Tuesday September 13, 2016 @08:08PM (#12493291)
Debugging or not, you must never store the CVV per guidelines. Send it out, done.
[ Parent | on HN ]