Canon hit by Maze Ransomware attack, 10TB data allegedly stolen

Valvebounce

CR Pro
Apr 3, 2013
4,549
448
57
Isle of Wight
As of a few years ago, they shouldn’t, I used to have suppliers for classic car parts where I could ring up and order bits without giving card details, that all went away (and probably rightly so) in favour of security.

Cheers, Graham.

How do sites store your card for subsequent purchases then?
 
Upvote 0
How do sites store your card for subsequent purchases then?
by an ID. usually the card gateway ie: a company like authorize.net stores the card # etc but that's validated and approved by visa, etc. the end company ie: a canon or ie: me or anyone just gets a generic "id". now if a hacker ever broke into authorize.net or a large payment gateway ... wow, it'd be hell.

Alot of that depends though on your transactional volume as welll, different rules apply, but most likely it's fine. but always keep an eye on yourcard.

btw, even a charge going on your card doesn't necessarily8 mean you were hacked, stolen, etc - wells fargo told me that at times the card readers at the store, get the combination right on the numbers and accidentally get "wrong" numbers during the swipe - faulty reader,etc.
 
Upvote 0

Michael Clark

Now we see through a glass, darkly...
Apr 5, 2016
4,722
2,655
Or Linux.

In all seriousness, I have an order from the Refurb shop in the pipeline. Or do I?

And presumably they were hanging on to my card number to charge it when it became available...so the hackers now have it.

It doesn't matter what OS you're running when stupid employees click on links designed to entice them to be unable to resist clicking on it.

Too many people can't help themselves and will open emails with a title like "Your FedEx shipment rescheduled" even when they haven't ordered anything.
 
  • Like
Reactions: 1 users
Upvote 0
Mar 25, 2011
16,847
1,835
It doesn't matter what OS you're running when stupid employees click on links designed to entice them to be unable to resist clicking on it.

Too many people can't help themselves and will open emails with a title like "Your FedEx shipment rescheduled" even when they haven't ordered anything.

Yes. I order a lot of stuff online and am always worried about malware. I've added some filters to my email that do a good job of removing scams, but every month or two, I spot one that got thru. When they get personal data with names and emails, they can craft more convincing fake emails, so its a matter of time before they get me. I have backups on my NAS as well as removable drive and Snapshots stored in a supposedly secure area of the NAS that is not susceptible to locking. I also am in the process of backing up the snapshots, I had to get a 2nd compatible NAS and the hard drives are not here yet. Large hard drives get expensive when you need several.
 
Upvote 0

RunAndGun

CR Pro
Dec 16, 2011
498
187
The credit card processors and companies have rules about how to store your card number. They keep updating the requirements and making it tougher. Finally, I just stopped accepting credit cards and let people use one thru Paypal or Amazon rather than deal with it. Canon has had such tight restrictions on credit card use due to the high value of the transactions that it can be frustrating. I doubt if credit card info would be in any usable form, but if names, addresses, etc were revealed, it can result in fraud and id theft.

Card companies do not allow the CVV to be stored, but a seller can choose to process without a CVV.

Yes. Trying to buy through Canon’s site with your CC can be a pain. Several years ago I bought a 100-400vII, because I had a nice discount code from Canon. It ended up taking about 3-4 days at least to make the purchase. After I’d complete the transaction, I’d get a email from Canon hours to a day later saying that they had cancelled it(lens was in-stock). I of course checked with my CC company and there were no issues and they weren’t blocking it. After several attempts on-line, I finally ended up having to make the purchase over the phone with a CSR.

The same purchase from B&H would have taken maybe 30-60 seconds and I would have had the lens in-hand in less time than it ultimately took to just complete the order. But of course the discount code was only for a direct purchase from Canon.
 
Upvote 0
Canon has been pretty silent, but it is obviously very bad. They have brought some things back up.

I know....the sites are still down and they are just “working on things”..... Corporations don’t just “work on websites for days”. I think the whole ordering system has been hit with the ransomware.
 
Upvote 0

DJL329

EOS R5
CR Pro
Aug 26, 2010
622
89
www.flickr.com
Newsday has the first "mainstream" media report i have seen on the situation. They apparently have an official response from Canon, confirming the ransomware attack.

 
Upvote 0
Newsday has the first "mainstream" media report i have seen on the situation. They apparently have an official response from Canon, confirming the ransomware attack.


Why do they think hiding and not saying anything is a good move?

Nikon’s unbelievable silence on the 70-200 2.8 z lens is why I have left them for Canon and here Canon sits silently.

I am surprised Canonrumors Isn’t getting some dirt on this as well
 
Upvote 0
Mar 25, 2011
16,847
1,835
Security people checking out the intrusion do not want details leaked until they have totally gone thru everything on the network. It gives hackers clues just by letting them know what and when the issue was discovered. If a hacker knows your capabilities, they can mitigate some of them, so it is a matter of concealing what you know from the enemy or from other potential intruders.

Eventually, some info will trickle out.
 
  • Like
Reactions: 1 user
Upvote 0

CanonOregon

Having fun with what I have to shoot with now.
Sep 12, 2012
67
12
Oregon
Well crap - guess I won't be getting my RF refurb afterall. Hope Canon recovers quickly!
I hoped so too but it's now onto 'Day 8' or so, crazy! The Federal Government needs to create a task force to go after these guys, you'd think they could track these guys down and make THEM pay for their crimes! Well, once back up there may be a bunch of bargains in the 'refurb bin'!
 
Upvote 0

SteveC

R5
CR Pro
Sep 3, 2019
2,677
2,589
I hoped so too but it's now onto 'Day 8' or so, crazy! The Federal Government needs to create a task force to go after these guys, you'd think they could track these guys down and make THEM pay for their crimes! Well, once back up there may be a bunch of bargains in the 'refurb bin'!

Generally they are either overseas, or hiding behind an overseas corporation in some third world country that doesn't give a damn.

That's true of the spam callers too. In that case, even with some US company's involvement, what happens is the FCC fines them a million dollars for breaking the robocall regs, the company declares bankruptcy so it doesn't have to pay anything...and a week later a new company is set up. The people committing the fraud are overseas somewhere and part of a different shell corporation, so the US company is only on the hook for violating FCC regulations.
 
Upvote 0