Cinema voucher-pusher tells customers: Cancel your credit cards, we've been 'attacked'

Re: UK Law Must Introduce Guest Checkout

Regrettably most companies treat PCI-DSS as an annual check-box exercise, cause they see it as a distraction and road block. Where if they used it as its intended, i.e. methodology / framework that would deliver a more hygienic practises, whilst this will not prevent a breach, it will speed up detection and remediation.

If you work for a company who's considering taking credit card payment.. take my advise, use a 3rd party payment services provider, that you can redirect the customers too. It will reduce what you have to do to be PCI-DSS compliant from 50-100 pages demands, down to about 10... (you'll fill in a SAQ A, rather than SAQ A-EP).

Re: UK Law Must Introduce Guest Checkout

You don't even need guest checkout, just don't save credit card info after payment -- or at the very least, let the customer decide if you should "remember" that credit card.

Re: UK Law Must Introduce Guest Checkout

"The UK must be changed to allow for a guest checkout, such that your card details are NEVER stored on their systems"

From the article:

"bank details were stolen from the payment page"

Demanding changes to the law to avoid storing details isn't going to help when storing details didn't have anything to do with the issue in the first place.

Re: Kill all middleman companies

Especially when a recurring topic in consumer protection forums is "We bought/were given a voucher by <insert defunct company name here>. What are our rights ?"

A: "Back of the queue, sucker."

Personally I think it's a little ... parsimonious of people to give vouchers rather than the best voucher of all ... cash.

Re: Kill all middleman companies

Used voucher company once for a cheap meal voucher, a month later phoned restaurant to book and they were still called the same name but apparently under new ownership so weren't honouring the vouchers. Had to get a refund. Never again.

"why are cheap cinema tickets such a popular "perk" for these flingers!?"

Does anyone ever pay full price for cinema tickets? How does the price at LifeWorks compare with the discounts available elsewhere?

"(why are cheap cinema tickets such a popular "perk" for these flingers!?)"

These days, being sent to the cinema is a punishment, not a perk. Unless you are lucky enough to have a nice, local and independent cinema that still cares about the customers.

(why are cheap cinema tickets such a popular "perk" for these flingers!?)

I'd say that they are expensive rather than painfully expensive.

And it's because it's inexpensive for them to offer, not prone to refunds owing to companies changing ownership, and so on. And people do still like going to the cinema. Whether that makes those people foolish is a question for another pub.

Re: TLS version?

I think you'll find you can get a dispensation after that in certain circumstances...

Re: Hard for customers to swallow this?

At least you have some sort of canteen! Working in the "city", employers dont have to provide one because of the copious amounts of branches of EAT/Pret....which means a sandwich which Sodexo will sell you for £2.50 or less costs about £7 for the same ineddable crud......

Re: CREST- who the hell are they

crest.com is toothpaste...you need to put a lot in a server to make it secure...unless you go for the PSU.

Re: CREST- who the hell are they

They’re a not-for-profit organisation (which is another way of saying the shit ton of money we get for doing very little goes to the C Suite pay bucket) that is meant to provide a degree of certainty that the penetration tester you’re paying for isn’t shit.

Sodexo are clearly blame shifting here - “pen tester said it was fine”.

Ofc Sodexo went with the cheapest option, which doesn’t mean the lowest day rate, it means the lowest number of days. Give a pen tester a couple of days and they’ll find the easy stuff, but that kind of time boxing leaves them very little chance of finding the truly interesting stuff.

Then you’ve got scoping issues - PCI compliance testing is all about getting as little stuff tested as possible (because it’s faster, and time is money). A pen tester won’t touch an out of scope box, else it’s career over. If Sodexo didn’t provide sufficient info to allow the engagement to be appropriately scoped then a vulnerable box might not get tested (chances are the pen tester didn’t know it existed).

Attackers on the other hand don’t give a damn about scope. They’ll go poking until they find something, then move laterally looking for exciting new toys to break.

I’d wager the initial breach was via an unscoped box. I’m not certain, but it’s not uncommon.

Re: Sodexo website was PCI compliant

"Any idea as to the technical nature of the breach?"

It sounded to me like they (sodexo) had absolutley zero idea of even where the breach was nevermind how, and (ludicrously imho) seemed to think switching the website off would solve it for now.