Chain reaction cycles security breach

tillson

Esteemed Pedelecer
May 29, 2008
5,249
3,197
I purchased a set of Magura brakes from them about 18 months ago using my credit card. About a week later, my bank phoned to see if I had ordered £7500 worth of of computer gear from the USA, which I hadn't, so they cancelled my card and sent me a new one. I can't say for sure that responsibility lies with Chain Reaction, but the thought did cross my mind at the time. The service was good though and the brakes are excellent.
 

flecc

Member
Oct 25, 2006
52,817
30,381
Most likely their computer system compromised by a trojan, but possibly an employee/ex employee copied out data.
.
 

eTim

Esteemed Pedelecer
Nov 19, 2009
607
2
Andover, Hants.
I purchased a set of Magura brakes from them about 18 months ago using my credit card. About a week later, my bank phoned to see if I had ordered £7500 worth of of computer gear from the USA, which I hadn't, so they cancelled my card and sent me a new one. I can't say for sure that responsibility lies with Chain Reaction, but the thought did cross my mind at the time. The service was good though and the brakes are excellent.

It begs the question: how long has it been going on for and why has it just gone public and why was nothing done about it sooner?
 

piotrmacheta

Esteemed Pedelecer
Jun 23, 2009
316
0
It just shows the value of the this forum. I opened my credit card statement this evening and spotted an O2 £15 purchase and thought it strange. Then by accident came across this thread and realized I had bought from CRC on 4th March so rang the credit card company and they say that someone has spent over £1000 with on-line purchases.
In nearly 30 years of using a credit card and 10 years of prolific on-line purchasing, this is the 1st time I've had this issue. And now they have to send me a new card and next week I'm off to Morocco for a month with no card!
What a world, thanks CRC and thanks pedelecs for the early warning. So check your statements now.
Just thought I'd have a rant.
 

NRG

Esteemed Pedelecer
Oct 6, 2009
2,592
10
Its not just CRC the big boys also get it wrong. My card had to be re-issued after the Apple iTunes store got hacked...
 

allen-uk

Esteemed Pedelecer
May 1, 2010
909
25
Whenever it's an option, I pay for internet stuff by PayPal, as it's always seemed marginally less insecure than credit cards. (Now I wait patiently for the links to stories of massive PayPal hacking...)


A
 

flecc

Member
Oct 25, 2006
52,817
30,381
It's essential to keep receipts or notes of purchases and check every statement, I usually check the recorded transactions online durig each month at least once and then at month end, before any paper statement received.

I was only ever compromised once and on that occasion the card company's automatic transaction security checking picked it up instantly and got in touch. Full marks at that stage. That was with a brand new card that had been used three times over two days, so I was able to positively identify the retailer and even the individual who had stolen the card details and say how they'd done it. Would the card company or the police act against them? No, they were both not interested, each saying speak to the other.

I did act though, his employment ended immediately.
.
 

jerrysimon

Esteemed Pedelecer
Aug 27, 2009
3,292
112
Cambridge, UK
Whenever it's an option, I pay for internet stuff by PayPal, as it's always seemed marginally less insecure than credit cards. (Now I wait patiently for the links to stories of massive PayPal hacking...)
A
I too try and select that option though as you say its probably only marginally more secure.

I checked and my last purchase from them was October. I was about to order a couple of Kojak tyres and brake blocks from them so the heads up was useful. Their prices are often good.

Jerry
 

deadmonkey

Pedelecer
Nov 21, 2010
87
1
GL12
Erm, paypal more secure than credit cards? I'm pretty sure that's far from true. I believe credit cards are protected by the consumer credit act, there's no such protection for paypal. I use it quite happily, I'm just saying they have issues too.

Some more information here - UK cyclists hit by fraud after online purchase at website • The Register

See the comments section for (much!) more discussion, including the pros and cons of paypal too.
 

allen-uk

Esteemed Pedelecer
May 1, 2010
909
25
Erm, paypal more secure than credit cards? I'm pretty sure that's far from true. .
No, what I said was "PayPal, as it's always seemed marginally less insecure than credit cards" .

And to an extent I stand by that, although I agree, PayPal is not the Road to Consumer Enlightenment, no more than the thieving credit card companies are. PayPal blocked payments to WikiLeaks, just like Visa (and was it Mastercard?)

I use them for smallish payments, below £100, so probably not covered by consumer credit acts relating to cards anyway. And glancing at PayPalsucks.com, interesting though it is, I didn't find any HACKING stories there, which is what this thread is about.


A.
 

deadmonkey

Pedelecer
Nov 21, 2010
87
1
GL12
Less insecure is not the same thing as more secure?

I bow to your semantics ;)

Yes, I didn't really look at paypalsucks, but did see a mention that one of their terms explicitly excludes the protection of the consumer credit act, so it's hobson's choice either way.

From what I've seen of feedback, people either used paypal and weren't affected, or used credit cards and got their money refunded from the card company, so hopefully that will be it.

Doubtless it will harm chain reaction a lot, which is a shame as the few items I'd had from them were good value and prompt.
 

allen-uk

Esteemed Pedelecer
May 1, 2010
909
25
Hmm.

When my doctor, in future, tells me that I've always seemed marginally less insane, I'll take it that he thinks me sane, then.

They'll probably just lock me up and throw away the semantics.


A
 

ghostrain

Finding my (electric) wheels
Nov 21, 2010
15
0
Don't be too quick to blaim the retailer with a credit card security breach...I am not saying it's not possible but our own mail order auto company was visited by a HSBC anti-fraud agent who blaimed us for a security breach on our website, it appears that we were the common purchase point on 28 cards that were subsequently defrauded,this was 28 cards on 19000 transactions. He wanted me to spend £8000 a day with HSBC's recommended forensic internet investigator,the work would have been 3-4 days,not a small sum for a small company. I investigated these defrauded cards more thoroughly and found that they were mostly located in Finland,Austria and Portugal, I also found out that HSBC's processing centre in Spain had been hacked and banks in Finland,Austria and Portugal had found it necessary to replace all cards that had been processed through the HSBC centre. I pointed this out to the HSBC agent,who previously had told me that HSBC were hack-proof,when I told him about the HSBC centre security breach he said he knew nothing about it,I found that hard to believe. Strange that after that the agent never returned and he lost interest in pushing the forensic investigation work! I tell this story in full because I am sure that the retailer is very worried,as I was and my website contractor. We investigated the coding in our website and could find absolutely no evidence of a breach in our encription. These banks are not hack-proof, during my problem an internet search revealed many security breaches of the bank's systems,not just HSBC so don't 100% blaim the retailer. The banks will always blaim the retailer and threaten big fines if the retailer is persuaded he is at fault but often their own house is not watertight.
 

morphix

Esteemed Pedelecer
Oct 24, 2010
2,163
119
Worcestershire
www.cyclecharge.org.uk
I had this happen to me once too... somehow someone got hold of my credit card details and tried to place an order online with tesco direct of all places!

My credit card company (Barclaycard) put a block on my card and notified me right away. Full marks to them for spotting it.

I have a policy of only using a credit card for online purchases and payments, as not only does it give you the extra protection for fraud, but with a fairly low fixed credit limit, exposure is limited, compared to exposing larger balances in bank accounts.
 

allen-uk

Esteemed Pedelecer
May 1, 2010
909
25
I've taken the liberty of copying Ghost's reply to Chain Reaction, as I am sure they will be glad of the support from a fellow retailer.

Allen.