A database problem with a U.S. domain name registrar exposed sensitive financial and personal information related to thousands of domain name registrations, a Dutch private investigations company said.
New York-based DiscountDomainRegistry.com fixed the problem shortly after being notified yesterday, said Nico Van den dries, CEO of Strongwood, a private investigation company based in the Netherlands.
DiscountDomainRegistry.com CEO Alex Brecher said in an e-mail to the IDG News Service that the company is 100% positive customer data was not compromised. The “alleged vulnerability,” he wrote, was patched within minutes after the company was contacted by Strongwood.
A DiscountDomainRegistry.com official wasn’t initially convinced there was a problem “At first, they didn’t believe us until we presented him with his own password,” Van den dries said. “And then he knew we were in.”
On its Web site, DiscountDomainRegistry.com, founded in 1998, says it registers domain names for $14.99 per year, including those of Fortune 500 companies.
The damage could have been severe. The credit card data and personal information from DiscountDomainRegistry.com clients could have been sold. Further, access to usernames and passwords would have allowed an intruder to change the names and IP addresses associated with Web sites, a method used for so-called phishing scams, Van den dries said.
Van den dries estimated it would take “little skill” with MySQL to exploit the bug. “If a bad guy found this leak and had access to the database … then I’m sure it could have cost millions,” he said. Ekkelenkamp said he received a call last night from the owner of DiscountDomainRegistry.com, thanking him.