Massive DigitalRiver Data Theft Investigated

Authorities are currently investigating India-based hackers and a 20-year old New York resident following a massive data theft of the e-commerce company, Digital River. It was alleged that the 20-year old attempted to sell the information to a Colorado marketing firm for half a million dollars.

This information came to light on Thursday when a reporter attended a court case where it was revealed that Digital River obtained a secret court order last month in preventing Eric Porat from selling, altering, destroying or distributing purloined data on almost 200 000 individuals.

According to information reported, Digital River suspects the information was stolen by Indian hackers, possibly with internal assistance. Porat acknowledge that he obtained the information from India, but refused to reveal from whom the information was obtained. Attorneys of Digital River suspect that Porat may have hacked the hackers in obtaining the information.

The data was originally gathered by companies that offer Affiliated Marketing programs. Direct Response Technologies, a Digital River subsidiary based in Pittsburgh, sells a leading software program called DirectTrack to assist companies in creating and managing affiliated marketing programs. Data collected by this program is stores on Digital Rivers’ servers and access to this information is restricted by means of password protection and other security measures. It is alleged that this is where the breach occurred.

Documents filed alleged that Porat attempted to sell the information to  marketing firm, Media Breakaway, as well as some of their competitors, for an amount of $500 000. According to Media Breakaway they initially spurned Porat’s offer. When he persisted, the company notified Digital River and the assisted the FBI in the investigation.

According to Media Breakaway Porat informed them that he obtained the information from DirectTrack with the assistance from a former consultant of Digital River, who captured it during an enhancement of the DirectTrack data system when security systems were suspended temporarily.

DigitalRiver confirmed that according to their investigation the data was accessed on the 27^th of January 2010 from four different computers linked to a DirectTrack customer in New Delhi named vCommission, or Vaxat iTech, Pvt Ltd. They stated that the data was downloaded using a ‘highly unusual’ search command.