New York-based online bookseller Barnes & Noble.com has been slapped with a $60,000 fine after a flaw exposed sensitive customer data on its Web site.
As part of a settlement with New York State attorney General Eliot Spitzer, Barnes & Noble.com will pay the fine and establish an information security program to protect personal information collected during e-commerce operations.
The book retailer has also agreed to establish management oversight and employee training programs and hire an external auditor to monitor compliance with the security program.
Exposure of sensitive customer data is a recurring problem faced by e-commerce firms. Malicious attackers are a constant threat and design flaws to e-commerce software are always a risk.
In fact, it was a design flaw in Barnes & Noble.com's Web site that led to the exposure of sensitive customer information, including names, billing addresses and account information. In this case, Spitzer's office said credit card numbers were not divulged.
During an investigation, the New York attorney general said the design vulnerability "permitted unauthorized access to consumers' accounts and personal information and enabled users to make purchases on the site from consumers' accounts."
The flaw arose from Barnes & Noble.com's use of "cookie-less" shopping, a feature that avoids the use of "cookies" . Cookies are normally used by Web sites to identify users and sometimes prepare customized Web pages for them.
"In certain situations (such as a consumer forwarding or posting a web page link), the consumer information in the URL was inadvertently posted or forwarded to third parties," the AG's office said.
"Consumers are concerned about how their personal information is secured and protected by online merchants. Our effort here should help assure that the terms of Barnes and Noble's Internet privacy policy are met."
This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml. If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner.
| 
