Neo Beat–an online Japanese Supermarket–reported that data on nearly 13,000 customers was compromised as a result of a SQL injection attack against its database. Credit card companies have reported that there have been fraudulent charges racked up as a result of the stolen customer data.
A report from Japan Today states “A source close to Neo Beat, which also operates the websites of these online supermarkets, said it believes that the approximately 30,000 unauthorized accesses to its database server were likely ‘‘perpetrated by a group of professional hackers.” Japan Today also states “The company’s investigation has found that its database program has a security vulnerability which made it difficult to block attempts from outside to intrude into the database server.”
Organizations should have sufficient perimeter defenses to prevent unauthorized access to internal servers, and there should be tools in place to monitor access and detect suspicious activity, but there are two other lessons to be learned here. First, IT admins need to stay informed of vulnerabilities affecting critical systems like customer database servers and make sure they are patched in a timely manner. Second, had the data been protected with encryption–using a tool like Zecurion Zserver Storage–the hackers would have retrieved nothing but useless gibberish and the customer data wouldn’t be compromised in spite of the other security weaknesses.
