After Anonymous attack, Stratfor CEO calls credit card storage a ‘failure’

Global intelligence firm Stratfor relaunched its website this week following a large-scale cyber attack conducted by hacker collective Anonymous. The Christmastime breach stole the credit card data of thousands of members and knocked the site offline for over two weeks.

In a new message to customers, Stratfor Founder and CEO George Friedman owned up to the serious internal security failures which left client and subscriber data easy pickings and called Anonymous’ attack “a new censorship.”

Friedman apologized to Stratfor members whose information was stolen in part due to the company’s decision not to encrypt credit card data stored on its website.

“This was a failure on our part,” he said. “As the founder and CEO of Stratfor, I take responsibility for this failure, which has created hardship for customers and friends, and I deeply regret that it took place.”

Friedman explained that the lax online security was a side-effect of Stratfor’s “rapid growth.”

“As it grew, the management team and administrative processes didn’t grow with it,” he said, adding that the company is “taking aggressive steps” to rectify past mistakes and protect both clients and subscribers moving forward.

Anonymous hacked Stratfor in early December as part of Operation AntiSec, publishing stolen credit card information, private emails and passwords just before Christmas. One victim, former Texas Department of Banking employee Allen Barr, reported his card was used to make $700 in charitable donations. Days later, the group leaked the names, emails and passwords of 75,000 paying Stratfor customers.

Acknowledging that future attacks are still a possibility despite its new efforts to safeguard private data, Friedman remained undaunted.

“I dedicate myself to denying our attackers the prize they wanted,” he said. “We are returning to the work we love, dedicated to correcting our mistakes and becoming better than ever in analyzing and forecasting how the world works.” (via Naked Security)