Anonymous Stratfor Hack: Public Supporters Of Company Also At Risk

NEW YORK (AP) — Victims of a data breach at the security analysis firm Stratfor apparently are being targeted a second time after speaking out about the hacking.

Stratfor said on its Facebook page that some individuals who offered public support for the company after it revealed it was hacked "may be being targeted for doing so."

The loose-knit hacking movement "Anonymous" claimed Sunday through Twitter that it had stolen thousands of credit card numbers and other personal information belonging to the company's clients. Anonymous members posted links to some of the information Sunday and more on Monday.

Stratfor, based in Austin, Texas, said its affected clients and its supporters "are at risk of having sensitive information repeatedly published on other websites." The company has resorted to communicating through Facebook while its website remains down and its email suspended.

A message posted online Monday by a group asserting it spoke for Anonymous mocked victims who spoke to The Associated Press about the experience of learning that their credit card information was stolen and used to make unauthorized charitable donations. The message also ridiculed someone who criticized the hacking on Facebook, saying "we went ahead and ran up your card a bit."

A Stratfor spokesman would not say whether the information was encrypted in its database or what the company has learned since the incident began.

Anonymous has said the data was not encrypted. If true, that would be a major embarrassment for a security-related company.

The spokesman, Kyle Rhodes, said the company could not discuss any details because several law enforcement agencies are investigating the incident.

The data was posted in a series of releases in links embedded in online messages that, in turn, were linked to from Twitter.

Some of the files appear to be alphabetical listings of Stratfor clients with related credit card information. The amount posted suggests that information about more than 100,000 individuals and thousands of companies was exposed. The posts also contain files of emails within Stratfor's information technology department, and what appears to be a list of passwords for Stratfor IT staff.

The posted data identifies thousands of major financial, defense and technology firms, media companies, government agencies and multiple units of the United Nations as Stratfor clients. The hackers said this was evidence that they had breached Straftor's "private clients," a claim the company denied.

"Contrary to this assertion, the disclosure was merely a list of some of the members that have purchased our publications and does not comprise a list of individuals or entities that have a relationship with Stratfor beyond their purchase of our subscription-based publications," Stratfor said in an email and on Facebook.

Stratfor clients around the world were trying to assess whether they were impacted by the hacking.

In New Zealand, the lead government agency, the Department of Prime Minister and Cabinet, is checking whether it has suffered any problems from the hacking. The department, New Zealand's police and fire services and national carrier Air New Zealand are among New Zealand agencies and companies using Stratfor for security purposes.

Department spokesman Ron Mackey said checks were under way to determine "whether its systems have been compromised," Radio New Zealand reported Tuesday.

Earlier, New Zealand technology commentator Colin Jackson said the hacking must be "really, really embarrassing for Stratfor."

"The government departments and (New Zealand) companies ... are going to have to go around and get those credit cards stopped, and decide whether to continue dealing with this outfit Stratfor," he said.

Stratfor "has made a press statement saying 'oh, this kind of thing happens to everybody and it's pretty hard to keep these guys out.' Yeah, right, well, you are supposed to be security experts," Jackson told Radio New Zealand.

The hackers initially claimed their goal was to use stolen the credit information to donate to charities at Christmas, and some victims confirmed unauthorized transactions were made from their credit accounts in recent days. The messages also said the hackers are targeting companies "that play fast and loose with their customers' private and sensitive information."

Stratfor provides political, economic and military analysis to help clients reduce cyber security risks, according to a description on its YouTube page. It charges subscribers for its reports and analysis, delivered through the web, emails and videos.

The company's home page carried a banner Monday that said its "website is currently undergoing maintenance."

Anonymous warned it plans more attacks this week. The movement has previously claimed responsibility for attacks on credit card processors Visa Inc. and MasterCard Inc., eBay Inc.'s PayPal, as well as banks, groups in the music industry and the Church of Scientology.

The Privacy Rights Clearinghouse, a watchdog that tracks data breaches, made the Stratfor hacking its 121st such incident of the year targeting credit cards.

Anonymous, reported to be a loose-knit group of hackers, became famous for attacking the companies and institutions that oppose anti-secrecy website WikiLeaks and its founder Julian Assange. The message Monday said the attacks could be averted. "Have you given our comrade Bradley Manning his holiday feast yet, at a fancy restaurant of his choosing?" Manning is the Army private facing court martial for allegedly sending hundreds of thousands of diplomatic documents and Iraq and Afghanistan war zone field reports to WikiLeaks. A seven-day hearing into the biggest national security leak in U.S. history ended Thursday.

Related on HuffPost:

Comments

[Post31]

11:52 AM on 12/28/2011

Haha you lose

[War peace]

10:50 PM on 12/27/2011

Anonymous did NOT do this... I am curious about these stories, they are manufactured and fed to the press for a reason

[Eris23]

09:03 AM on 12/28/2011

And you base this assertion on what exactly? Who officially speaks for Anonymous?

[empress trudy]

05:27 PM on 12/27/2011

It's all fun and games till Huffington Post gets attacked.

[Rehbock]

01:01 AM on 12/28/2011

Yes.I remember the days of yore when this was not among the most censored sites. Oh well. Justa reminderto all - if you ahve asecret dont put it on a computer

[empress trudy]

05:26 PM on 12/27/2011

The key to this is their anonymity. If they lose that then the first order of business is to hack them to death. Literally. Empty their bank accounts, mess with the hospital equipment keeping any of their family members alive, mess with their car electronics, GPS or any of the electronic equipment they use in their day jobs. I am 100% serious on this point. If they want a war to the death, I am game for it.

[Eris23]

07:35 PM on 12/27/2011

I say we take off and nuke the entire site from orbit. It’s the only way to be sure.

[kayyy]

03:17 PM on 12/27/2011

I have been consistently stating the same thing over and over. If you are stupid enough to use the internet for business or credit cards of any kind, you get what you deserve. Cash is king. All any one needs is a individual savings account for tax / legal reasons. beyond that you don't need any thing else. It just gives up to much control/ profit to others.

Yeah that's right profit. Right now this very instant behind your back some entity is taking your life property and using it to buy-sell-manipulate-etc. They are making a profit off of you / your information without your knowledge, permission, or even a royality for your life propertry.
The consequnces of these industries are you have no protection from the businesses, the hackers or any one else. Only you are responsible for the consequences.

Your sole purpose in life is to just pay and pay and pay...This is part of the reason we have lost so many rights, freedoms and privileges. You have no idea how bad this can be until it hits you hard. When you finally see it as not somebody else, then you'll learn some basic protections.

Use an egodentity on the internet, in businesses, and in most I.T activities.
Cancel your cards, pay all your debts down to zero-fast. Find away to cash your pay checks the same day you get them issued in person, put it in your savings account for taxes & legal.

[Gary Storch]

10:49 AM on 12/28/2011

Try buying an airline ticket or renting a vehicle without a credit card.
The system is going the way of a "card" to be used for everything in the very near future. By the end of 2013 you will not be able to write checks for anything. Doing away with the paper.
Your cash is becoming extinct.
We will all have a number attached to our ONE card and that will suffice for everything.
This is not fiction.

[kayyy]

03:47 PM on 12/28/2011

A) I have bought airline tickets with cash in Reno Nv. and San Diego Ca. I have rented cars (recently) with cash in Seattle Wa. San Diego Ca. U-Haul in San Diego Ca. and Reno Nv.
B) The other form of cash is cashier's check or debit card on savings or checking accounts.Watch out for checking accounts as they can be electronically accessed without your knowledge.
C) The only reason why we are changing to a non-cash system is because people are letting it become the emerging standard rather than continue normal business. The companies and banks are merely responding to customer usage / habits. If we don't get back to cash as the primary very soon we are going to lose a great deal.

[iamwired]

03:07 PM on 12/27/2011

The ABOUT page for Stratfor is still cached, and it looks like Antisec posted lots of taunts on it before they took it down. I would link it here, but after they taunted the IT manager ot Stratfor, they posted his personal info and credit card number.
Interesting read

[wizardneedsbeer]

03:05 PM on 12/27/2011

Another attempt at making someone do
what they dont wanna do
Thats the American Way !

[RecreationalPilot]

03:02 PM on 12/27/2011

Their passwords weren't even encrypted?

That kind of makes me wonder about Google. I called about a billing issue and it seemed that the staffer knew what my password was along with being able to view all of my emails.

===

Even the data security folks should not be able to view passwords, they should be encrypted for them as well, since it could tip them off to how the user sets their password scheme. Data Security should just have the rights to create revoke, reset, remove and grant specialized access to userids - NEVER see their passwords.

[kayyy]

03:38 PM on 12/27/2011

Goggle has been accused of going through yahoo e-mails after the buy in. probably not true? I don't worry because I use an egodentity. I'm very careful about the info i say, write or give to anyone. passwords are supposed to be encrypted and changed very often. So what? Every time you use your password into something tell your self one thing. "This protection doesn't exist everyone can see my worse side and use it againist me." I know it's stupid but after a few times you will better understand what to give out. It's mostly used as a teaching method.

[Charles Queen]

02:13 PM on 12/27/2011

It's been determined that most of the major hacking is being done by some small groups of chinese in china,and they are also getting help and suppor from the chinese government as well.How long are we going to keep allowing the chinese government to keep allowing this to happen.Perhaps we should start getting into al of their government and military and tech files and see what they have to say about it

[Bobolini]

01:23 PM on 12/27/2011

Stratfor is not a security company. They are a "post" for geopolitical analysis. A lot of these "old school" newsletter types are loosey goosey about security and Stratfor fits that group. They were low hanging fruit and a crime of opportunity. They left the door wide open because they are cavalier and full of themselves. I would guess this was about embarrassing Friedman and his organization.

Friedman is an x-CIA analyst. Inside those agencies there are a lot of fiefdams. They sabotage each other and would jump at the opportunity to embarrass someone they consider a has been desk jockey. Just a guess, but I don't think this has anything to do with Anonymous or Bradley Manning. It might be about a personal vendetta easily executed.

[IndependentGadfly]

02:06 PM on 12/27/2011

Good point about Stratfor not being a security company. Friedman was never a CIA Analyst or employee. He was a professor who specialized in National Security. He got lots of gigs as a consultant to various National Defense Agencies before he hung up his own shingle.

Not sure why he and his company were singled out, but various news agencies are reportint that it was an "arm" of Anonymous that did the deed but that other parts of it objected. His work is pretty benign but is often insightful.

[dfstone]

11:51 AM on 12/27/2011

I find it hard to believe that a security company wouldn't encrypt their database of credit card information, like Anonymous claims.

[Catherine Lynch Monks]

12:06 PM on 12/27/2011

You don't want to know how many companies take the cheap and easy way out. Add to that the fact that all you need is one dumb@$$ employee to open the wrong attachment or go to the wrong site at work and you have quite a mess.

[cuckoosnest]

12:07 PM on 12/27/2011

Maybe it is encrypted... but accessed via a security flaw (SQL injection) that by-passes any benefit of encryption...

[Eris23]

12:50 PM on 12/27/2011

SQL injection doesn't do any good against encryption. If someone gained access to data via SQL injection, it would be of no use if it was properly encrypted. The fact is that a company like Strafor, which charges money for its so-called security expertise, should have known this.

[euug0701]

11:42 AM on 12/27/2011

I don't understand why the media isn't doing its due diligence in reporting this story. Anonymous has denied responsibility for this attack:
“The Stratfor hack is not the work of Anonymous. Stratfor is an open source
intelligence agency, publishing daily reports on data collected from the open
Internet. Hackers claiming to be Anonymous have distorted this truth in order
to further their hidden agenda, and some Anons have taken the bait,” the group
claimed in an online communiqué.

“The leaked client list represents subscribers to a daily publication which is the
primary service of Stratfor. Stratfor analysts are widely considered to be
extremely unbiased. Anonymous does not attack media sources.”

[IndependentGadfly]

12:24 PM on 12/27/2011

NPR is reporting that is was an "arm" of Anonymous. I find it amazing they would choose STRATFOR to hack. They are non partisan and have a broad customer base. Why the arm of Anonymous would choose STRATFOR is disturbing. They took their credit card, log in and password information and then turned around and charged donations to charities to them. This goes beyound "hacktivism" and into the realm of crime. They are attacking private citizens.

[Eris23]

12:53 PM on 12/27/2011

How is that statement any more valid than any other that comes out of "Anonymous?" There's also Barret Brown's response.

"Stratfor was not breached in order to obtain customer credit card numbers, which the hackers in question could not have expected to be as easily obtainable as they were. Rather, the operation was pursued in order to obtain the 2.7 million e-mails that exist on the firm's servers. This wealth of data includes correspondence with untold thousands of contacts who have spoken to Stratfor's employees off the record over more than a decade. Many of those contacts work for major corporations within the intelligence and military contracting sectors, government agencies, and other institutions for which Anonymous and associated parties have developed an interest since February of 2011, when another hack against the intelligence contractor/security firm HBGary revealed, among many other things, a widespread conspiracy by the Justice Department, Bank of America, and other parties to attack and discredit Wikileaks and other activist groups. Since that time, many of us in the movement have dedicated our lives to investigating this state-corporate alliance against the free information movement."

http://pastebin.com/WPE73rhy

[IndependentGadfly]

02:11 PM on 12/27/2011

The irony of that statement is that Stratfor would like find some favor withe Anonymous crowd. Stratfor offers analysis but they never attack or discredit any organization. Stratfor maintains a degree of integrity above others and is widely respected by most parties. They would more than likely over analyze Wikileaks than criticize them. They cultivate their sources like any other intel group but if Anonymous wanted to shut them down, they would likely lose an ally.

[iamwired]

04:14 PM on 12/27/2011

If you look at the defaced webpage, it is signed by AntiSec.

[cuckoosnest]

11:35 AM on 12/27/2011

Stratfor should have been compliant with the payment card industry data security standards (PCI-DSS). Shame on them for not having encrypted databases holding client information. However, they probably don't have a merchant account and use a 3rd-party payment processor. In which case, they would have no reason to directly comply with PCI standards... but still pretty lame.

It is a cat and mouse game, and security "pros" will always be one step behind. Security is not an absolute -- anyone who says otherwise is lying or ignorant. Having played both sides of the game, I'd say the number one cause of security incidents is ignorance. Shame on Stratfor!

As a company, or as an individual, you must be proactive in protecting yourself and mitigating the risks. I recommend the following book for the layperson to get a handle on their own security:

The Art Of Privacy: Top Secret Level PC Security For Non-geeks
http://7d019it62kv07xc7m2si-1k23o.hop.clickbank.net/?tid=11HFP1227

[ravencalling]

11:43 AM on 12/27/2011

Yeah I would be pretty upset with the company for not encrypting my data or allowing their site to be injected as one poster stated in another similar article. If it were not anony it would be someone else. Its a level of trust that you give companies and I would say they are culpable because there ARE measures that can be taken to mitigate risk. But it takes investment, so its not always willful ignorance. I would say this is how much the company is willing to spend on it's customer's security and satisfaction, and I would also say the bad publicity if all the above is true is well deserved.

[cuckoosnest]

11:58 AM on 12/27/2011

Agreed -- not all cases are willful ignorance, security is an IT cost-center like you correctly pointed out. A company must invest in its security at a level that strikes a balance between cost and accepted risk.

[PenguinLinux]

02:03 PM on 12/27/2011

Sadly, I don't think the average lay person will ever be as secure as a computer geek will. They don't like to get in and tweak the minutiae and stay on top of things. Many think that just updating Windows and AV software will secure them, yet they use Adobe Reader (outdated often times), Flash, etc, which are security holes in themselves.

Security isn't a setting, software or hardware; it's a 24/7/365 mindset that is part of your lifestyle. It's a balancing act of awareness, knowledge, education and implementation to a degree that far exceeds the interest of Joe Sixpack.

[IndependentGadfly]

02:15 PM on 12/27/2011

Good points. For the novices amoung us, what do you substitute for Adobe Reader and Flash? They are so pervasive. I got a virus recently from Flash and am not sure how it even happened. I had to restore my windows based system to a previous saved snap shot to get rid of it.

[Lex Anton]

09:12 AM on 12/27/2011

They are not speaking out really. The Stratfor customers are asking for to hang the hackers and insinuate violence. Thats why they are being called out.

[Hontas Farmer]

09:19 AM on 12/27/2011

I have read tons of quotes on this. No one directly involved that I have seen has called for violence.

[Lex Anton]

09:23 AM on 12/27/2011

Well if you follow on twitter it's there.

[IndependentGadfly]

12:26 PM on 12/27/2011

Wouldn't you be upset if someone stole your log in informaiton and credit card data and made charges?

[NIB82]

01:15 PM on 12/27/2011

You bet I would, and it happened to me in the past year. Thankfully the credit card super computer traces caught in dead in the tracks beginning with an attempted .90 charge to a charity going to an attempted 2K overseas purchase for an Apple computer. I have been ringing the bells for Salvation Army for 4 years, and only donate cash or check; I would know what donations I made or didn't make to the charities. Bunch of low life's (criminals, not charities) - where is a good deep moat and hungry Nile crocks when you need them?! The Fourth Horseman...

[Lex Anton]

02:45 PM on 12/27/2011

No. I'd be mad at the company who I have given that information to for not securing my information properly.