[ISN] Boston Globe in credit card data snafu

[InfoSec News]

http://money.cnn.com/2006/01/31/news/companies/security_bostonglobe.reut/

January 31, 2006

SAN FRANCISCO (Reuters) - Two Massachusetts newspapers owned by The
New York Times Co., the Boston Globe and Worcester Telegram & Gazette,
said Tuesday they had mistakenly sent out slips of paper with the
credit card data of up to nearly a quarter million subscribers.

The credit card numbers were printed on routing slips attached to
9,000 bundles of newspapers sent to retailers and carriers last
weekend, according to the newspapers.
 
"Immediate steps have been taken internally at the Globe and Telegram
& Gazette to increase security around credit card reporting," Richard
H. Gilman, publisher of the Boston Globe, said in a statement.

The credit card data of up to 240,000 subscribers may have been
exposed, they said.

The blunder comes amid heightened concern over the security of
consumer data in the wake of several incidents of lost or stolen
personal records involving companies such as data broker ChoicePoint
Inc., Bank of America Corp. and shoe retailer DSW Inc.

So far, the newspapers had not received any reports of misuses of the
credit cards, and American Express, Discover, MasterCard and Visa had
been advised of the situation, said Boston Globe spokesman Al Larkin.

Exposure of the data occurred because the Telegram & Gazette, which
helps circulate both papers under a shared distribution system,
printed the routing slips on recycled paper containing internal
reports with subscriber credit card numbers, Larkin said.

"We've put a stop to that," Larkin said of the practice of reusing
paper.

The Globe's circulation was 450,000, according to Larkin. He did not
have a daily number for the Telegram & Gazette, but said the Sunday
edition had a circulation of 81,000.

The newspapers were trying to locate and recover as many of the slips
as possible, but believed that most had already been thrown away.

The publications had set up a hotline, 1-888-665-2644, for subscribers
to check if their data was sent out. The papers are part of The New
England Media Group, which is owned by The New York Times Co.