In this edition of Qualys’ infosec news digest, we look at Orbitz’s data breach, AMD’s vulnerabilities controversy, and recent actions by the U.S. government against alleged Russian and Iranian cyber spies.

Orbitz was (kinda, sorta, maybe) hacked

Orbitz disclosed last week that personal information linked to almost 900,000 payment cards may have been compromised, after it detected a “data security incident” in which “there was likely unauthorized access” to customer data.

The customer data at risk includes payment card details, full names, dates of birth, phone numbers and e-mail and home addresses.

Orbitz doesn’t think that passport numbers nor travel itineraries were compromised. It doesn’t collect Social Security numbers. Orbitz, which is owned by Expedia, isn’t sure if data was stolen, but a privacy rights experts recommends that customers not rest easy.

“I think consumers should assume that their personal information has been compromised even though they may not have been notified. There have been so many data breaches that you just can’t assume that you haven’t been affected,” Beth Givens, executive director of the Privacy Rights Clearinghouse, told Consumer Reports.

Continue reading …