{UAH} CREDIT CARDS SOLD ON DARK WEB

Saint John cyber attack: Credit cards sold on 'dark web' for over a year

Connell Smith

39 mins ago

 

© CBC CBC The City of Saint John is beefing up its security systems in the wake of a breathtaking security breach that left the public's credit card information, wide open to hackers.

In December, the city's IT staff learned that for the past 18 months, the municipal server for collecting parking ticket fines had been infected with a malware outbreak.

It gave hackers access to names, card numbers, card verification numbers, expiry dates, and addresses for as many as 6,000 people who paid their parking fines using credit cards online, in person, or over the phone.  

Load Error

On Dec. 19 IT World, an online publication, reported the breach of the click2gov software, citing Saint John specifically in the article, even though 46 other municipalities across North America were affected. 

City wasn't notified of the breach 

The story didn't come to the attention of city staff until Dec. 21, and by that time the municipality still hadn't been notified by click2gov's manufacturer, CentralSquare Technologies.

The city quickly shut down the click2gov server halting online payments, but by then sensitive information belonging to card users had already been for sale on the so-called  "dark web" for 15 months.

"Why weren't we notified? Why did we have to find out in an article?" asked Saint John Mayor Don Darling at a Monday night council meeting.

"It wouldn't meet my definition of a partnership in the CentralSquare folks, the click2gov folks that we were working with."

Five weeks later, the city's parking fine server remains offline while arrangements are being made with an alternate service provider.

Number of stolen credit cards unknown

© Google Street Google Street

In the meantime Stephanie Rackley-Roach, the city's acting director of corporate performance, said the Canadian Institute of Cyber Security will perform a threat assessment on the city's IT systems.

Security measures will be evaluated, antivirus software improved and more robust fire walls will be installed. There will also be further training for IT staff and others who use the system. The city will also purchase cyber insurance as a precautionary measure.

The city still isn't sure how many credit cards were stolen and later sold. But Saint John police have received 18 complaints since the city issued public notice of the security breach on Dec. 21.

In an update to its Dec. 19 article, IT World reported the cards stolen in the click2gov hack were sold on the dark web for an average of $10 U.S. each.

EM         -> { Trump for 2020 }

On the 49^th Parallel          

                 Thé Mulindwas Communication Group
"With Yoweri Museveni, Ssabassajja and Dr. Kiiza Besigye, Uganda is in anarchy"
                    Kuungana Mulindwa Mawasiliano Kikundi
"Pamoja na Yoweri Museveni, Ssabassajja na Dk. Kiiza Besigye, Uganda ni katika machafuko"