Krister Rollins reports:
The Maine Attorney General’s office is issuing an alert for people who may have used an out-of-state service for buying tickets for shows and other forms of entertainment recently.
The service, Venidini (sic), Inc., has been hacked, exposing financial information for tens of thousands of customers.
Vendini sent a letter to Maine’s Attorney General about the breach. Vendini’s letter says that on March 29th, someone broke into a server that contains the names, addresses, email addresses, credit card numbers and credit card expiration dates of tens of thousands of people, 22,900 Mainers among them.
Read more on WCSH. A statement on Vendini’s blog, posted yesterday, reads:
Statement from Vendini Regarding Unauthorized Entry into its Systems
We regret to inform you that on April 25, 2013, Vendini, Inc. detected an unauthorized intrusion into its systems. Vendini provides box-office and online ticketing services to hundreds of Vendini members, which include tour, casino, sports, arts, and entertainment venues and promoters across the U.S. and Canada. If you used a credit card to make a purchase for an event through Vendini’s services, then your personal information may have been involved in this incident. For more information, please contact us at the number provided at the end of this posting.
We are actively cooperating with federal law enforcement, and this posting was delayed specifically to support law enforcement’s investigation.
A full-scale, internal investigation is under way at Vendini with outside computer forensic and cyber security experts. Although our internal investigation is ongoing, we believe that in late March, a third-party criminal actor used hacking technologies to access our databases and may have accessed personal information, such as name, mailing address, email address, phone number, and credit card numbers and expiration dates that belong to our members’ consumer-patrons. It is important to note we do not collect credit card security access codes (e.g., CVV, CVV2, PINs), information that is typically needed to complete a credit card transaction. Consumer-patron usernames or passwords were not accessed by the intruder.
Upon discovering this intrusion, we engaged computer forensic and cyber security experts to commence an investigation. We implemented enhanced security measures designed to prevent a recurrence of this type of incident. We notified our merchant banks; and credit card companies have been alerted. To protect against the possibility fraud, we urge all of our members’ consumer-patrons to remain vigilant, to review credit card account statements and to monitor credit reports for any unauthorized activity. In addition:
• Do NOT respond to any requests for sensitive personal information in relation to this incident. Vendini will never request such information via email or telephone unless it is absolutely necessary to respond directly to a member or members’ consumer-patrons regarding how this incident may have impacted them.
• In order for consumer-patrons to protect against the possibility of unauthorized use of your credit card, we encourage you to regularly review your credit card account statements for any unauthorized activity.
• If any consumer-patron suspects that he or she may be a victim of fraud, we recommend immediately contacting local law enforcement, the State Attorney General’s offices and the Federal Trade Commission. We are making available a Resources Guide here for further information that may be of assistance.Our business is built on our ability to provide trusted services to our members and their consumer-patrons. This trust is founded on data protection and privacy, which is our highest priority. We want to see those involved in this incident found and fully prosecuted.
Vendini took immediate steps to correct the problem and ensure the safety of patron information, and we will continue to provide all services without interruption. We are committed to protecting our members and their consumer-patrons. We will work diligently to maintain your trust and confidence in our company and services.
• If you are a consumer-patron, and you wish to learn more about this incident, please click here or contact us toll-free at 1-800-836-0473.
• If you are a Vendini member, please contact your member advocate, or contact us toll-free at 1(800) 901-7173.
Mark Tacchi, President and CEO
Ruth Lutes, VP Customer Success
Dave Loewith, VP Engineering and Operationsposted by Mark Tacchi Tuesday, May 21, 2013 @ 5:46 PM
To protect against the possibility fraud, we urge all of our members’ consumer-patrons to remain vigilant, to review credit card account statements and to monitor credit reports for any unauthorized activity. In addition:
These morons just sent me an email about it- 2 months later. IDIOTS.
Indeed.
The incident was discovered end of April, and they waited until end of May to inform their customers.
Why the delay?
Note their statement that they delayed notification to support law enforcement’s investigation. That’s not uncommon.
I’m waiting to find out how far back their database went and an explanation as to why they were storing credit card numbers, and seemingly unencrypted ones at that. My bet is that at least one state attorney general opens an investigation and demands that consumers be provided with free credit monitoring services.
I’m also wanting to know why they were storing credit card info. I bought tickets in early March. My credit card expired the end of April, so I’m not too worried, but I agree that there needs to be an investigation.
I think they are actually still being hacked. According to this, they had attacks in late March and late April… however, as far as we can tell… we only used them once in mid-May (bought tickets to a show that uses the company) and we’ve detected illegal activity on our credit card as well.
They should be paying for credit and identity theft monitoring… The thieves have enough info to do more than a trivial amount of damage.
I haven’t been to a concert in years, why do they still have my credit card information?
For all the talk about how these outfits (in their privacy policies) “strive” to “protect” our information, when an “incident” occurs, they incur virtually NO culpability in whatever damage occurs. We get an apology and a plea to be diligent. That’s gotta change… this is a perfect example of where government involvement, in the form of oversight or something more, is needed. And the hackers that are caught & convicted need to have their assets seized, in addition to stiff minimum sentences… 10 years no parole would be a good starting point.
The scope of this breach seems to be flying under the national media radar, but based on what I’m reading, I suspect this breach is very large. Keep in mind that nothing stops you from filing a complaint against Vendini with the Federal Trade Commission if you think the firm has engaged in “unfair” or “deceptive” practices under the FTC Act. The FTC has an online complaint form on their site if you decide to file a complaint.