Story image

Expert says Cash Converters cybersecurity breach ‘yet ANOTHER wakeup call’

21 Nov 17

Late last week it was announced that Cash Converters had been breached with hackers potentially having access to the account details of thousands of UK customers.

Cash Converters operates high street stores that allows customers to trade in items like electronics and jewellery in exchange for money.

The affected website that enabled people to purchase these products online was taken offline in September this year after it was replaced by an updated version.

In addition to the cash trade-ins, Cash Converters also offers small loans to customers.

The hackers that attacked the now inactive website are believed to now have access to usernames, passwords, delivery addresses and partial credit card numbers of its UK-based customers.

As is the case with a lot of modern cyberattacks, the group is now holding the information to ransom – with the threat to release the data if they’re not paid – while the firm works with law enforcement authorities to investigate the incident.

CTO of Data Protection at Gemalto, Jason Hart says this an attack that could have been easily prevented.

“This is yet another case of a company not protecting the sensitive customer data it holds," Hart says.

“While no credit card information was taken, hackers were able to access usernames, passwords and addresses, which can be used to launch social engineering attacks.”

Hart says that hopefully this should serve ‘as yet another wakeup call’ that businesses need to protect this type of data at its source.

“Through methods like encryption, hackers may be able to take the data, but not actually be able to read it, ensuring it can’t be used,” Hart says.

“It’s incredibly frustrating to see these attacks continue to hit the headlines, given the relative ease of methods that are out there now to prevent them.” 

Cash Converters has released a breach notification email to its customers, with a spokesman saying:

“Please be reassured that, alongside the relevant authorities, we are investigating this as a matter of urgency and priority.

“We are also actively implementing measures to ensure that this cannot happen again.

“Although some details relating to the cybersecurity breach remain confidential while Cash Converters works with the relevant authorities, we will continue to provide as much detail as possible as it becomes available.

“The current webshop site was independently and thoroughly security tested as part of its development process. 

“We have no reason to believe it has any vulnerability, however additional testing is being completed to get assurance of this.

“Our customers truly are at the heart of everything we do and we are both disappointed and saddened that you have been affected. 

'We apologise for this situation.”

AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.
Dropbox strengthens security with raft of new partnerships
Integrations will keep customer content protected and secure with tools for controlling identity access, governing data, and managing devices.