Greysheets Website was Hacked

AACoinCo · December 16, 2003 4:55AM

FYI: I received a letter this week from the United States Postal Inspection Service and it stated “After a forensic examination of the suspect’s (Amirsarmad Mirzadehazad) computer, a spreadsheet containing information was discovered. This information consisted of Social Security Numbers, Dates of Birth, Addresses, and Credit Card information.” Apparently 18 months ago the Coin Dealer Newsletter or Greysheet had their web site hacked and the entire database of customer information was downloaded. Check you’re CC’s carefully!

I spoke with a Diane Downing at the CDN and she said that they indeed knew that the information was hacked. Although they knew that this information had been obtained they failed to inform their customers of the potential for a fraud to inflicted upon them by this scumbag. Diane asked “what do you want me to do about it?” I wanted her company to inform me, the consumer. In this way I could take precautions by canceling the card and thus prevent potential problems.

With the type of information obtained the person could open charge accounts, start telephone and other services and thus ruin your hard won credit. I find the action of CDN to be an egregious abuse of our trust and the consumers should let them know your feelings.

PS-I ordered my credit report today!

ms70 · December 16, 2003 5:01AM

Where did you order your report from? I better check mine.

kranky · December 16, 2003 5:02AM

&*$#%@!!!!!

How can they NOT INFORM THEIR CUSTOMERS! That's ridiculous!

Thanks a lot, CDN! I'm done with you, right after you hear from me directly about this.

I just read an article about identify theft and sometimes these people sit on the information for a year or two, waiting for people to reduce their vigilance. How wonderful, having to monitor my credit report for the next five years or more.

Jerks.

BTW, thanks for letting us know, Bob. I do appreciate it.

SportsModerator2 · December 16, 2003 5:10AM

Can anyone provide me with a website address?

Thanks,

Carol

Wolf359 · December 16, 2003 5:12AM

Greysheet address? Greysheet

Placid · December 16, 2003 5:13AM

www.greysheet.com

dlimb2 · December 16, 2003 5:16AM

When was it hacked , if they can not look out for their customers then I guess its out of business for them...

seanq · December 16, 2003 5:18AM

Huh... just today I received this little piece of marketing genius from them, too (the highlight is mine):

They're not exactly inspiring confidence in me.

Sean Reynolds

SportsModerator2 · December 16, 2003 5:21AM

Duh!

I typed that (I thought) but it didn't work. I guess my spelling abilities are getting worse as I get older.

I see from the posts that they didn't notify anyone directly. Did they post this on their site any where?
I'd be interested in knowing how they got in and what they are doing to prevent it from ever happening again.
We have such strict security measures implemented by our IT guys for our systems that I find it interesting to see how other sites security measures were circumvented.

Carol

AACoinCo · December 16, 2003 5:34AM

At the bottom of the letter from the US Postal Inspection Service they provided the names, addresses and telephone numbers of the three major credit reporting agency's: More than courteous, and they suggested checking your report for any irregularities.

Equidax CRB
800-685-1111

Experian
888-397-3742

Trans Union
800-916-8800

The sad part about this is that the Federal Government is looking out for my interest better than one of my industry peers!

poptopsRus · December 16, 2003 5:35AM

I got the same letter from the United States Postal Inspection Service about a month ago. I wondered where this Amirsarmad Mirzadehazad got my information. I did a credit report on myself and didn't find anything wrong.

291fifth · December 16, 2003 5:35AM

I've never been wild about the "sheets". Now I am even less wild about them. Failure to inform their customers of this major security breech is unacceptable business behavior.

AACoinCo · December 16, 2003 5:36AM

Diane Downing said that they did imediatly impliment a new firewall. They did not inform any of their customers according to her.

GOLDSAINT · December 16, 2003 5:40AM

I think the hacker changed all the priceing in these sheets also, I knew I was paying to much for these coins!!
No wonder the dealers think this market is WHITE HOT !

agentjim007 · December 16, 2003 5:43AM

I'm an idiot about this kind of stuff. I did give Greysheet my CC info to order one of their packets about 18 months ago. I watched our bill carefully for a long time after that. My wife has lost about 3 credit cards since then meaning the card I had when I ordered is long cancelled. That saves my ass...right?

elwood · December 16, 2003 5:45AM

How do we find out if our info was on the hackers spreadsheet?

agentjim007 · December 16, 2003 5:45AM

"I think the hacker changed all the priceing in these sheets also, I knew I was paying to much for these coins!!
No wonder the dealers think this market is WHITE HOT ! "

Now thats funny

AACoinCo · December 16, 2003 5:47AM

Not necessarily. The information taken included you birthday, SSN, and other pertinent facts about your person so anyone could request a CC in your name, set up a utility account or do something else despicable. It is not just limited to that particular event or credit card.

g097103 · December 16, 2003 5:51AM

Have to check mine. If they do any business in CA (I'm sure they do) they are REQUIRED to report any
incursion and loss of customer private data, failure to do so can have 'consequences'. Might be worth
making a few calls to some associates in the network security industry out that way.

tjkillian · December 16, 2003 5:53AM

I just called Diane Downing and she said that they were not going to notify anyone and that it is the job of the Postal Inspection to do that

She said that no one has complained and that she was completely indifferent to any complaints. She said that each person should check their own statements to see if anything has gone wrong, as if we would know that it was the Greysheet that caused the problem. I am very angry at them and her personally as she does not want to take responsibility for her actions

Tom

kranky · December 16, 2003 5:53AM

<< If they do any business in CA (I'm sure they do) they are REQUIRED to report any
incursion and loss of customer private data, failure to do so can have 'consequences'. >>

CDN is located in California.

tradedollarnut · December 16, 2003 5:54AM

Why in the world would you ever give a company, such as CDN, your Social Security Number?

g097103 · December 16, 2003 6:04AM

Civil Code 1798.82. In a nutshell, the law states that any person or company doing business in the state of California is responsible for notifying California residents of security breaches to their non-encrypted information. It is important to note that the actual breach does not need to occur in the state of California for the law to apply. As long as a company is doing business in the state, "doing business" defined as: having a registered agent in the state of California, having a physical office, contracting to do business with vendors in the state (parts manufacturers, suppliers), or having retail outlets in the state, they are liable to notify their California customers. However, if you are strictly a mail order business, with no ties to California except your online customers, this law may not apply to you at all.

So they might be off the hook if they only interact online, but I suspect that is not the case.

Russ · December 16, 2003 6:05AM

<< Why in the world would you ever give a company, such as CDN, your Social Security Number? >>

I was just wondering exactly the same thing. Once a month I buy a copy off their web site, and it has never asked for my SS#.

Russ, NCNE

agentjim007 · December 16, 2003 6:17AM

I never gave CDN SSN# or Birthdate. I'm sure they just got name address cc# and exp date.

BillJones · December 16, 2003 6:21AM

The only info I've ever given to CDN was my PO box address and some checks. I think that puts me in the clear.

MadMarty · December 16, 2003 6:21AM

I'm safe I signed up for mine using Russ's credit card!

pontiacinf · December 16, 2003 6:24AM

I worked for the major bureaus for years...anyone needing to check their credit needs to check all 3.

www.transunion.com

www.experian.com

www.equifax.com

ms70 · December 16, 2003 6:25AM

I think the only thing I ever gave them was my CC#. I never renewed my subscription & that CC is long gone.

supercoin · December 16, 2003 6:26AM

Wow, I guess I'll be getting a notice as well. There is NO excuse for CDN not notifying their customers immediately! Ridiculous that the government (of all people) would notify you more efficiently. When you register on their site, you give them an e-mail address. How hard would it be to simply e-mail everyone???

FYI, as recently as a couple weeks ago, CDN is still storing your credit card information. I ordered a sheet and then went back and changed my credit card number to something bogus. Glad I did.

It's something to be careful with whenever you are purchasing online. Most people know you shouldn't transmit sensitive information unless you're on a secure connection (https:// in the address and that little padlock icon in the bottom of your browser) but that only protects the information from being intercepted while you are communicating with the web site. It does nothing to protect your information after the web site gets it.

And credit card numbers are generally stolen by someone hacking into a database (as happened to CDN), or physically gaining access to the computer storing the database, not by intercepting individual web browser transactions.

In my opinion a small company (like CDN) simply does not have the technical resources or budget to responsibly protect an on-site database of card numbers.

I'm definitely of the small-variety company

, so when I take credit cards on my web site I just pass the information along over a secure connection to the processor. I do not retain any credit card numbers myself.

Deadhorse · December 16, 2003 6:35AM

Hmm. I recently got my subscription through eBay and paid through paypal, so I guess I'm safe.

Russ · December 16, 2003 6:36AM

I do the same as Tad. No customer information stays on the server. It's a bit more inconvenient for the customer since they have to enter everything each time they purchase, but I sleep well knowing that in the seven years I've been selling over the web no data has ever been compromised.

And, I'll tell you what. If the average consumer were aware of how many times a day hack attempts are made against merchant sites it would scare the crap out of them. Even as a very tiny business, I get dozens a day.

Russ, NCNE

supercoin · December 16, 2003 6:37AM

Another FYI... many credit cards now have a way to generate a one-time use card number on their web site. You can then use that number to make a purchase at a site with questionable security (like CDN). If the number is later stolen, it doesn't do the thief any good.

razorface1027 · December 16, 2003 7:08AM

AAAHHHHHHHH stop WHININ'! Your credit card info. can be hacked at any time, through/by any hacker weather it be purchasing gas, clothes, food, cars, housing, coins and last but not least CDN. Guess what, they're teaching our children; those that have children in advanced computer science classes, to hack systems just for the fun of it to see just how computer savvy these kids really are. They were teaching my son in 7th & 8th grade to perpetrate such acts about the internet. "Sad but TRUE!"...

GOLDSAINT · December 16, 2003 7:17AM

Joking aside! here is something you can do if you are concerned. Call your credit card company, the 1-800 number is on the back of your card. Tell them the situation and ask them to put a fraud alert on your card. Watch your bills as they come in and if anything shows up that you did not buy call the card company and they will eat the charge or back-charge it to the seller. Most card companies will do this anyway, but if you alert them to the situation you have no hassel. If bad charges do show up, request a change in your number and they will send you a new card. They dont like to change your number unless necessary, but will once one bad charge shows up. They make a computer record of all personal inquiries, and your call will stay on the computer for 12 months. If you are the pariniod type you can also request a printed copy be sent of the fraud alert.

Barry · December 16, 2003 7:27AM

You guys are getting worked up over nothing.

Unless the credit card was actually swiped through a card reader (whcih is different than someone punching in the number on the machine) or your signature is attached to a credit slip, if you dispute the charge, the merchant has to prove its validity. It's NOT the other way around.

The credit card folks try to scare everyone with this stuff because if they don't catch the crook, they eat the charge and take the loss.

geb209 · December 16, 2003 7:43AM

Unforuntately Barry, it's not that simple. Card companies will require you to prove that you didn't make the purchase. Have you ever tried to prove a negative?

goose3 · December 16, 2003 7:50AM

I used to have a GM Mastercard until just about 1 year ago.

I am certain that I used it at least once to purchase some GS's online.

I cancelled it after buying my new truck and opened a different one that I have used 1 or 2 times in the past year.

here is GS's contact info!!!!!!!!!
Our Mailing Address is:
CDN
P.O. Box 7939,
Torrance CA 90504

Phone: 310-515-7369
Fax: 310-515-7534
Email: orders@greysheet.com

Russ · December 16, 2003 7:51AM

<< You guys are getting worked up over nothing.

Unless the credit card was actually swiped through a card reader (whcih is different than someone punching in the number on the machine) or your signature is attached to a credit slip, if you dispute the charge, the merchant has to prove its validity. It's NOT the other way around. >>

Tell that to somebody who becomes a victim of identity theft, has their credit history completely trashed, then spends months and even years cleaning up the mess.

<< Unforuntately Barry, it's not that simple. Card companies will require you to prove that you didn't make the purchase. Have you ever tried to prove a negative? >>

Actually, he's 100% correct. It is that simple with internet transactions. The merchant must prove the transaction, the cardholder has to do nothing but file the chargeback, stating the reason. If the merchant can't prove it's a legitimate transaction, the re-imbursement is automatic.

Russ, NCNE

Barry · December 16, 2003 7:56AM

geb,
I speak from both sides of the fence here - as a credit card user and as a merchant. It is up to the merchant to prove the charge was valid if the buyer disputes it.

Yes, I have disputed charges in the past. For example, a restaurant that double billed me for dinner. All I had to do was call the 800 number on the card, explain the dispute and the charge was temporarily removed until the investigation was complete. In this case, the merchant never responded to the inquiry, and the charge was permanently removed after about 60 days.

cointagious · December 16, 2003 7:59AM

you need make only one call. try equifax at 1-800-685-1111 and use the consumer fraud victim menu to obtain all 3 credit reports with one call.

coinkat · December 16, 2003 8:11AM

Why does CDN need that type of information? Since when are SSN's required for a simple subscription?

Geoman · December 16, 2003 8:32AM

Damn, I am glad I read this. I have been planning to sign up for the greysheet for the past 3 weeks. Just haven't found the time to do it yet. Now, I need to rethink if I will sign up. Their lack of proper business ethics surprises me. And with Diane's response, I don't know if I will sign up. Oh well, that's their lost, not mine.

nwcs · December 16, 2003 8:58AM

Well, this partially dives into my area as I work with web sites, web site security (mostly software, though some hardware), programming, and I even do stuff with TransUnion...

I'm stunned that they would not inform their customers! It may be a violation of their stated privacy policy if they had one in place when the breach occured. Also, if the breach occured before the regulations in CA or wherever went into the books then not much can be done to them.

Web site security is not necessarily easy, but with some vigilence, planning, and good programming the risks are very few. Judging from their website when I first saw it, they don't seem to have the best staff in place. Or the programmers/IT people cannot get the equipment they need. I'm taking a glance at it again right now... I don't want to monkey with it too much but I bet I could get a good cross-site scripting hack on it. And a good form post hack would probably work.

Obviously SSN is not needed by any company and I hate that they request it. Some even "require" it though I believe it's required to be optionally supplied by law now. Many companies try to get away with it until you remind them to use the newer forms and regulations. Then miraculously you get the "corrected" forms.

AmericanSilverEagleCoins · December 16, 2003 8:59AM

Once they get your CC# and address they can always match up your SSN and bank data using other means.

The reason it can be such a big deal is not how much money you are out of pocket with fraudulent purchases on your existing credit cards but trying to clear your credit history of fraudulent purchases. They can easily open up another account using the data retrieved and have statements sent to some phoney address. You will never even know your credit history was trashed but there will be plenty of default judgements against you since you are not even receiving statements, dunning notices or court documents. Then when you go to finance that next mortgage or car you'll be flagged.

elwood · December 16, 2003 10:15AM

test

cosmicdebris · December 16, 2003 10:27AM

18 moinths ago

(*&%*^%*&%* So that's how those *$&%$& got my CC number. I am pissed! I went through hell to get that mess cleared up.

FrattLaw · December 16, 2003 10:40AM

Do I hear the ever so slight rumblings of a potential lawsuit? Hmmmmmm.........

Michael

cosmicdebris · December 16, 2003 10:47AM

<< slight rumblings >>

I hear an earthquake coming!

Askari · December 16, 2003 11:22AM

<< She said that no one has complained and that she was completely indifferent to any complaints. >>

Talk about "clueless" -- duh!! How could anybody complain when they hadn't yet learned their info had been ripped off. It takes time for the inspectors to get notices out and then only after they'd nabbed the guy. Greysheet needs to get their legal act together!

docday2003 · December 16, 2003 12:08PM

Crazy. Talk about bad publicity....

Greysheets Website was Hacked

Comments

Leave a Comment