News for hackers. Stuff that matters.

A comment on DocuSign email address database breached and used for phishing campaign. Parent comment

Re:DocuSign email address database breached and used for phi... by Drisc0 on Tuesday May 16, 2017 @10:14AM (#14349715)
As someone who has worked on a similar product, I would imagine they only store a token given to them by their payment gateway. The actual CC information is held by the PCI compliant payment gateway, while Docusign can use the token to charge a card without storing compromising information.
[ Parent | on HN ]
Re:DocuSign email address database breached and used for phi... by tyingq on Tuesday May 16, 2017 @11:23AM (#14350271)
Would be good if that were spelled out though. From the outside, you click a link and see a pre-filled PDF, as both the end user and the person that sent the form. There's no obvious magic that it's auto-detecting cc like data and storing it differently than the other fields in the pdf.
[ Parent | on HN ]