Vendini hacked; customers’ credit card numbers possibly accessed
Krister Rollins reports:
The Maine Attorney General’s office is issuing an alert for people who may have used an out-of-state service for buying tickets for shows and other forms of entertainment recently.
The service, Venidini (sic), Inc., has been hacked, exposing financial information for tens of thousands of customers.
Vendini sent a letter to Maine’s Attorney General about the breach. Vendini’s letter says that on March 29th, someone broke into a server that contains the names, addresses, email addresses, credit card numbers and credit card expiration dates of tens of thousands of people, 22,900 Mainers among them.
Read more on WCSH. A statement on Vendini’s blog, posted yesterday, reads:
Statement from Vendini Regarding Unauthorized Entry into its Systems
We regret to inform you that on April 25, 2013, Vendini, Inc. detected an unauthorized intrusion into its systems. Vendini provides box-office and online ticketing services to hundreds of Vendini members, which include tour, casino, sports, arts, and entertainment venues and promoters across the U.S. and Canada. If you used a credit card to make a purchase for an event through Vendini’s services, then your personal information may have been involved in this incident. For more information, please contact us at the number provided at the end of this posting.
We are actively cooperating with federal law enforcement, and this posting was delayed specifically to support law enforcement’s investigation.
A full-scale, internal investigation is under way at Vendini with outside computer forensic and cyber security experts. Although our internal investigation is ongoing, we believe that in late March, a third-party criminal actor used hacking technologies to access our databases and may have accessed personal information, such as name, mailing address, email address, phone number, and credit card numbers and expiration dates that belong to our members’ consumer-patrons. It is important to note we do not collect credit card security access codes (e.g., CVV, CVV2, PINs), information that is typically needed to complete a credit card transaction. Consumer-patron usernames or passwords were not accessed by the intruder.
Upon discovering this intrusion, we engaged computer forensic and cyber security experts to commence an investigation. We implemented enhanced security measures designed to prevent a recurrence of this type of incident. We notified our merchant banks; and credit card companies have been alerted. To protect against the possibility fraud, we urge all of our members’ consumer-patrons to remain vigilant, to review credit card account statements and to monitor credit reports for any unauthorized activity. In addition:
• Do NOT respond to any requests for sensitive personal information in relation to this incident. Vendini will never request such information via email or telephone unless it is absolutely necessary to respond directly to a member or members’ consumer-patrons regarding how this incident may have impacted them.
• In order for consumer-patrons to protect against the possibility of unauthorized use of your credit card, we encourage you to regularly review your credit card account statements for any unauthorized activity.
• If any consumer-patron suspects that he or she may be a victim of fraud, we recommend immediately contacting local law enforcement, the State Attorney General’s offices and the Federal Trade Commission. We are making available a Resources Guide here for further information that may be of assistance.
Our business is built on our ability to provide trusted services to our members and their consumer-patrons. This trust is founded on data protection and privacy, which is our highest priority. We want to see those involved in this incident found and fully prosecuted.
Vendini took immediate steps to correct the problem and ensure the safety of patron information, and we will continue to provide all services without interruption. We are committed to protecting our members and their consumer-patrons. We will work diligently to maintain your trust and confidence in our company and services.
• If you are a consumer-patron, and you wish to learn more about this incident, please click here or contact us toll-free at 1-800-836-0473.
• If you are a Vendini member, please contact your member advocate, or contact us toll-free at 1(800) 901-7173.
Mark Tacchi, President and CEO
Ruth Lutes, VP Customer Success
Dave Loewith, VP Engineering and Operations
posted by Mark Tacchi Tuesday, May 21, 2013 @ 5:46 PM