EUREKA, Calif.–One of the best-known experts in the area of computer security and breaches is reporting his attempts to alert a credit union that its online banking system had been breached were rebuffed, and that it required several contacts to get the credit union to take the threat seriously.
Brian Krebs, the author of the well-known and respected Krebs on Security blog and website, noted in a blog posting, “Despite my best efforts, sometimes a breach victim I’m alerting will come away convinced that I am not an investigative journalist but instead a scammer. This happened most recently this week, when I told a California credit union that its online banking site was compromised and apparently had been for nearly two months.”
Krebs said he had been alerted to the problem by Alex Holden, another tracker of cybercrime, who had found a “Web shell” that allows a crook to remotely control the website and server, had been placed on Coast Central’s site.
Krebs reported that on Feb. 23 he contacted Coast Central CU to alert it had been hacked, “how they’d likely been hacked, how they could verify the hack, and how they could fix the problem,” but two days later the risk remained. He said he then contacted the CU’s IT department and spoke to two people who declined to take him seriously. Indeed, Krebs described himself as “exasperated” after his first two attempts to contact the CU.
Krebs said he finally was able to contact VP-IS Ed Christians who took the call and the threat seriously, and acted upon it. He reported “there is some evidence to suggest the site may have been hacked via an outdated version of Akeeba Backup — a Joomla component that allows users to create and manage complete backups of a Joomla-based website.
Click here for additional details on the type of attack perpetrated against the credit union.