[ISN] In Legal First, Data-Breach Suit Targets Auditor

From: InfoSec News <alerts_at_private>
Date: Tue, 2 Jun 2009 02:26:54 -0500 (CDT)
http://www.wired.com/threatlevel/2009/06/auditor_sued/

By Kim Zetter 
Threat Level
Wired.com
June 2, 2009

When CardSystems Solutions was hacked in 2004 in one of the largest 
credit card data breaches at the time, it reached for its security 
auditor’s report.

In theory, CardSystems should have been safe. The industry’s primary 
security standard, known then as CISP, was touted as a sure way to 
protect data. And CardSystems’ auditor, Savvis Inc, had just given them 
a clean bill of health three months before.

Yet, despite those assurances, 263,000 card numbers were stolen from 
CardSystems, and nearly 40 million were compromised.

More than four years later, Savvis is being pulled into court in a novel 
suit that legal experts say could force increased scrutiny on largely 
self-regulated credit card security practices.

They say the case represents an evolution in data breach litigation and 
raises increasingly important questions about not only the liability of 
companies that handle card data but also the liability of third parties 
that audit and certify the trustworthiness of those companies.

[...]


_____________________________________________
Visit the InfoSec News security bookstore!
http://www.shopinfosecnews.org 
Received on Tue Jun 02 2009 - 00:26:54 PDT

This archive was generated by hypermail 2.2.0 : Tue Jun 02 2009 - 00:37:57 PDT