HD Manufacturer LaCie Admits Yearlong Data Breach (opens in new tab)

(threatpost.com)

23 pointsnimbs12y ago17 comments

17 comments

9 comments · 5 top-level

donbronson12y ago· 3 in thread

LaCie should be forced to publish a list of priorities that were more important than fixing the site for leaky credit cards.

rhizome12y ago

There is a telling lack of consumer-protection laws regarding data leaks and breaches. Compare this with the Android flashlight-dataseller case [1], and you see that companies perceive the data you produce as rightfully theirs to do whatever they want with, except that which is legislatively protected (and even then...).

1. http://bgr.com/2014/04/14/brightest-flashlight-app-scam-sett...

wdewind12y ago

What's the solution? We hate regulation as an industry, but if I was outside the industry, seeing these data breaches over and over again would seem to imply a need for regulation. Looking at PCI and HIPPA, as two examples, it doesn't seem like data protection legislation would be super successful. Any thoughts on that?

3 more replies

tzs12y ago

I don't understand. The data was leaked from March 27, 2013 to March 10, 2014, but LaCie didn't know that was happening. They found out on March 19, 2014 when the FBI told them about it. I don't see how you infer from this miss-ordered priorities for fixing the site.

ToastyMallows12y ago· 1 in thread

Title is a little misleading. I own a LaCie External HD and I went there expecting something about hardware level data breaches.

0x012y ago

Indeed. Imagine what a competent attacker could do with access to the firmware developer or distribution environment. http://spritesmods.com/?art=hddhack&page=1

PCheese12y ago

The site just emailed me my password in cleartext when I used the "forgot password" option, so they must not be hashing them on their side. Seems like a terrible security practice.

The incident notification states "website user names and passwords could also have been accessed", so I guess this means cleartext passwords.

acqq12y ago

LaCie is not only a HD manufacturer, more importantly it is also the owner of the cloud storage service on the European servers:

http://www.lacie.com/more/?id=10142

"Cloud Collaboration. Rock-Solid Security."

http://www.wuala.com/

http://www.wuala.com/en/learn/technology

"Our servers are based in Switzerland, Germany, and France."

Which would be preferred by Europeans. Well now...

at-fates-hands12y ago

I'm no expert in security, but man am I weary of using ANY Adobe product. I guess I continue to confirm that feeling every time I see one of these data breaches and its tied to Adobe products.

j / k navigate · click thread line to collapse