Late last year, a hacker stole 300,000 credit card numbers from CD Universe and released thousands of them on a Web site when the music retailer refused to pay a ransom. In February, another hacker infiltrated RealNames , an Internet search service with as many as 20,000 card numbers on file. The company did not know for certain if numbers were stolen, so it asked card issuers to cancel accounts as a precaution. The industry as a whole needs to pull its socks up,'' said Alex van Someren, who heads security vendor nCipher in the United Kingdom. Merchants, he said, should maintain ''high standards'' if they want customers to return.
Security experts recommend merchants scramble credit card numbers once they complete transactions.
They also should move such data to computers unattached to those running the Web sites. At ProMobility.net , a Canadian company that sells wireless and Internet services, card numbers sat unscrambled on the same computer that runs its Web site. Last month, a hacker took advantage of a software security hole and stole almost 50,000 cards. In hindsight, maybe the company shouldn't have handled its own security, said Eric Geiler, a ProMobility executive. So far, no spending sprees have been reported.