Thousands of customers of a leading US security company are due to be given specialised identity theft protection after computer hackers linked to the Anonymous group claimed to have diverted more than $500 000 from their private bank accounts to charities including the Red Cross, Care and Save the Children.
The Robin Hood-style attack started on Christmas Eve and was aimed at clients of Stratfor, a security analysis company based in Austin, Texas. Hackers obtained thousands of credit card numbers and other personal information from the firm’s clients and started making payments to the charities.
The company’s chief executive, George Friedman, has told clients, which include several US government departments, foreign embassies, Interpol, the US army and the United Nations, that by Wednesday they will have received “identity theft protection and monitoring”.
In the meantime, he urged them to regularly check their accounts and credit reports and issued his “sincerest apologies” for the security breach, which makes it possible for anyone with access to the internet to download thousands of credit card account details, complete with security codes, in less than a minute.
The assault was believed to have been orchestrated by a branch of the loosely affiliated hacker group called Anti-Sec and appeared to be inspired by anger at the imprisonment of Bradley Manning, the US army private who is accused of leaking hundreds of thousands of US government files to WikiLeaks. An online statement from the group said the attack would stop if Manning was given “a holiday feast — at a fancy restaurant of his choosing”.
Credit card account details belonging to Stratfor clients at companies including Goldman Sachs, Shell and Nestlé were among those that appeared in the file posted online.
“On December 24 an unauthorised party disclosed personally identifiable information and related credit card data of some of our members,” Friedman said in a statement.
“We have reason to believe that your personal and credit card data could have been included in the information that was illegally obtained and disclosed. Also publicly released was a list of our members, which the unauthorised party claimed to be Stratfor’s ‘private clients’.
“Contrary to this assertion the disclosure was merely a list of some of the members that have purchased our publications and does not comprise a list of individuals or entities that have a relationship with Stratfor beyond their purchase of our subscription-based publications.”
One member of the hacking group, who uses the handle AnonymousSabu on Twitter, claimed that more than 90 000 credit cards — including those of law enforcement agencies, the intelligence community and journalists — had been hacked to make donations.
The hackers linked to images online that purported to be receipts for charitable donations made by the group manipulating the stolen credit card data. “Thank you! Defence Intelligence Agency,” read the text above one image that appeared to show an agency employee’s information was used to donate $250 to a charity.
The hackers have mocked those who complained about having money stolen and plundered their accounts afresh. They said in an online statement: “Let us not forget dear old Victor Gebilaguin, who posted the following on Stratfor’s Facebook wall in defence of the company: ‘The hackers ought to be shot then hanged upside down in public.’ Well, since you feel so strongly about it Victor, we went ahead and ran your card up a bit. Hope you don’t mind. Really guys, cry us a river.”
Stratfor urged its customers to exercise caution when complaining publicly about the hacking.
“It has come to our attention that our members who are speaking out in support of us on Facebook may be being targeted for doing so and are at risk of having sensitive information repeatedly published on other websites,” the company said in a statement.
“So, in order to protect yourselves, we recommend taking security precautions when speaking out on Facebook or abstaining from it all together.”
Fred Burton, Stratfor’s vice-president of intelligence, said the company had reported the intrusion to law enforcement agencies and was working with them on the investigation. The company said it had hired a specialist in identity theft and a second security consultant, but Burton warned “once they fixate on you or try to attack you it’s extraordinarily difficult to defend against”. —