By Rachel England, Engadget
Government Payment Service Inc — the company thousands of local governments in the US use to accept online payments for everything from court-ordered fines and licensing fees — has compromised more than 14 million customer records dating back to 2012, KrebsOnSecurity reports. According to the security investigation site, the leaked information includes names, addresses, phone numbers and the last four digits of credit cards.
KrebsOnSecurity alerted the company — which does business as GovPayNow.com — to the problem on September 14th. The site found that it was possible to view millions of customer records simply by tweaking the digits in the web address displayed by each receipt. Two days later, the payment site released a statement saying it had addressed a "potential issue," and that while there was "no indication that any improperly accessed information was used to harm any customer" the company has nonetheless updates its systems to prevent the issue reoccurring.
Government Payment Services Inc was acquired by Securus Technologies at the start of 2018. The Texas-based company provides telecommunications services to prisons, among other things, and has come under fire a number of times for data breaches this year alone. In May, it emerged that Securus was abusing its cell phone-tracking capabilities, then just weeks later hackers broke into its system and stole the online credentials of multiple law enforcement officials. As KrebsOnSecurity notes, fixing these information disclosure issues is relatively simple, so it's remarkable how many organizations are falling foul of these basic vulnerabilities — especially if their name, 'Securus' suggests they should really be on top of their game.
Government Payment Service Inc — the company thousands of local governments in the US use to accept online payments for everything from court-ordered fines and licensing fees — has compromised more than 14 million customer records dating back to 2012, KrebsOnSecurity reports. According to the security investigation site, the leaked information includes names, addresses, phone numbers and the last four digits of credit cards.
KrebsOnSecurity alerted the company — which does business as GovPayNow.com — to the problem on September 14th. The site found that it was possible to view millions of customer records simply by tweaking the digits in the web address displayed by each receipt. Two days later, the payment site released a statement saying it had addressed a "potential issue," and that while there was "no indication that any improperly accessed information was used to harm any customer" the company has nonetheless updates its systems to prevent the issue reoccurring.
Government Payment Services Inc was acquired by Securus Technologies at the start of 2018. The Texas-based company provides telecommunications services to prisons, among other things, and has come under fire a number of times for data breaches this year alone. In May, it emerged that Securus was abusing its cell phone-tracking capabilities, then just weeks later hackers broke into its system and stole the online credentials of multiple law enforcement officials. As KrebsOnSecurity notes, fixing these information disclosure issues is relatively simple, so it's remarkable how many organizations are falling foul of these basic vulnerabilities — especially if their name, 'Securus' suggests they should really be on top of their game.
