 |
Cable TV and ISP giant Comcast is moving to limit the fallout from a data breach that could have exposed hundreds of its customers’ account passwords online.
The breach came about thanks to a list of Comcast (NASDAQ: CMCSA) customers’ account names and passwords that had been posted to Scribd, a Web site for publishing and sharing documents that counts President Obama, FOXBusiness.com and the New York Times among its users and publishing partners. Initial reports put the total number of compromised accounts at 8,000, while Comcast said the actual figure was far smaller.
“We found out yesterday about the document posted on Scribd,” Charlie Douglas, a Comcast spokesperson, told InternetNews.com. “We notified them and they pulled it down. We found that there are only 700 accounts that appear to be current and active, and right now, we’re in the process of contacting each of these customers.”
A spokesperson from Scribd said that the company, which debuted a Flash-based publishing platform last year, took action as soon as it heard of the problem.
“We immediately removed the document and disabled the user account. We were contacted by a representative of Comcast shortly after that and we notified them that we’d removed the document and account,” they told InternetNews.com.
Comcast’s Douglas also said the ISP is notifying legal authorities about the breach and is working with the compromised accounts’ owners to mitigate the damage.
“Our security assurance team is calling those affected now. They go through a battery of questions to make sure that the customer’s PC is protected and that they are aware of the steps they can take.”
Comcast said it’s not yet sure how the information leaked to Scribd. Douglas said that the company does not believe that the passwords were taken from its network. Instead, he said it is likely that the compromised account holders may have been the victims of a potentially automated phishing attack, and that the document posted online may have been written by automated malware.
But the company’s investigation is not complete, he added.
“We don’t know where the document came from,” Douglas said. “It’s full of duplicates and out-of-date information, and was potentially assembled by a machine.”
Comcast is one of the nation’s largest ISPs. In its most recent annual report, Comcast reported 14.9 million broadband customers nationwide.
Douglas said that ISPs are attacked regularly, and that it is eager to raise its customers’ awareness of security issues. He said Comcast offers customers McAfee‘s security suite for free, but that not all of the company’s users are aware of the offer or take advantage of it.
That’s in spite of the fact that service providers are prime targets for data breaches and other cyberassaults. “Attacks by bots or malware happen all the time to ISPs and e-mail providers,” he said.
Update adds comment from Scribd.
