Threat of credit thefts has long existed in unscrupulous waiters copying down cards, or store clerks mishandling carbons. Late last year, a hacker stole 300,000 credit card numbers from CD Universe and released thousands of them on a Web site when the music retailer refused to pay a ransom. In February, another hacker infiltrated RealNames, an Internet search service with as many as 20,000 card numbers on file. The company did not know for certain if numbers were stolen, so it asked card issuers to cancel accounts as a precaution. Although no card numbers were stolen, the rush of fake traffic drew attention to other potential security breaches.
Security experts recommend merchants scramble credit card numbers once they complete transactions.
They also should move such data to computers unattached to those running the Web sites. At ProMobility.net, a Canadian company that sells wireless and Internet services, card numbers sat unscrambled on the same computer that runs its Web site. Last month, a hacker took advantage of a software security hole and stole almost 50,000 cards. In hindsight, maybe the company shouldn't have handled its own security, said Eric Geiler, a Promobility executive. So far, no spending sprees have been reported.