The Long Tail of Cold Fusion Fail
Summary: A criminal gang used unpatched Adobe ColdFusion vulnerabilities to build a botnet of roughly four dozen hacked e-commerce sites, including lighting retailers elightbulbs.com and Kichlerlightinglights.com, and milked them for customer credit card data. Elightbulbs.com learned of its breach on Nov. 7, 2013 from its processor Heartland Payment Systems after Discover flagged fraudulent card activity, despite paying a third-party compliance firm upwards of $6,000 a year that missed a flaw McLellan said had existed for two years.
Bottom line: Both lighting firms ultimately moved credit card processing off their own servers to third parties, after Kichler's owner described spending a ton of money on forensics - a reminder that the compliance testing you pay for is not the same as finding the flaw an attacker is already using.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026