Company Detected Years-Long Breach Only After Hacker Maxed Out Servers’ Storage

It’s the “failure to detect intrusions” that always results in
huge losses to the organizations.

Utah-based technology company InfoTrax Systems is the
latest example of such a security blunder, as the company was
breached more than 20 times from May 2014 until March 2016.

What’s ironic is that the company detected the breach only after
it received an alert that its servers had reached maximum storage
capacity due to a data archive file that the hacker
created.

InfoTrax Systems is an American company based in Utah that provides
backend operations systems to multi-level marketers, which also
includes an extensive amount of sensitive data on their users’
compensation, inventory, orders, and accounting.

The breach reportedly occurred in May 2014 when the hacker
exploited vulnerabilities in InfoTrax’s server and its client’s
website to gain remote control over its server, allowing him to
gain access to sensitive personal information for 1 million
consumers.

At the time, the United States Federal Trade Commission (FTC)
sued the company for failing to safeguard the personal information
the company maintained on behalf of its clients.

According to the FTC
complaint^[1], the hacker remotely
accessed the system 17 times over the next 21 months without being
detected and then began pulling the personal information of
consumers on March 2, 2016.

The stolen information included customers’ full names, social
security numbers, physical addresses, email addresses, telephone
numbers, usernames, and passwords for 4100 distributor and admin
accounts on the InfoTrax service.

The company discovered the breach on March 7, 2016, when it
began receiving alerts that one of its servers had reached its
maximum capacity, which was due to a massive data archive file that
the hacker created on its customers.

Surprisingly, the intruder managed to breach the company at
least two more times even after InfoTrax Systems became aware of
the intrusion.

Then again, on March 29, 2016, the hacker used the user ID and
password of a valid InfoTrax distributor account to upload more
malicious code to collect newly submitted payment card data from
that client’s website again.

According to the FTC, InfoTrax Systems failed to “inventory and
delete personal information is no longer needed, conduct code
review of its software and testing of its network, detect malicious
file uploads, adequately segment its network, and implement
cybersecurity safeguards to detect unusual activity on its
network.”

On Tuesday, the FTC published a press
release^[2], announcing a proposed
settlement, which requires InfoTrax Systems to implement a
comprehensive data security program that corrects the failures
identified in the complaint.

Besides this, the proposed settlement also requires InfoTrax
Systems to obtain third-party assessments of its information
security program every two years.