- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
IDG News Service - When Keith Bond bought a computerized cash register system for his Broussard, Louisiana, restaurant, he thought he was modernizing his restaurant. Today, he believes he was unwittingly opening a back door for Romanian hackers who have now cost him more than US$50,000.
Bond's is one of more than a half-dozen Louisiana restaurants that have sued the makers of their point-of-sale system, alleging that the companies that made and resold the systems are the ones who should be responsible for fines levied by payment processors following the hack.
His story reads like a warning for small businesses, who in connecting their businesses to the Internet, have also become prey for sophisticated cyber-criminals.
Bond says that systems at his Mel's Diner, Part II, were hacked, along with several other restaurants in the region, sometime around March 2008. Investigators told him that the systems were compromised by Romanian hackers who used the devices' remote access software to steal credit card numbers from the systems. This software let Bond's reseller, Computer World, provide remote support to the systems. The criminals took those credit card numbers and then used them to make fraudulent purchases throughout the U.S., he said.
In the class-action lawsuit, Bond and the other plaintiffs allege that their point-of-sale systems were out of compliance with the Payment Card Industry Data Security Standard (PCI DSS), which defines how secure the big credit card companies expect their merchants' computers to be. Bond and others blame the maker of his Aloha point-of-sale system, Radiant Systems, and its Louisiana reseller, Computer World (Computer World is not related to IDG's ComputerWorld magazine).
After the hack, Bond had to spend close to $20,000 to audit his systems. He was then assessed tens of thousands of dollars in fines and chargeback fees generated by the 699 credit card numbers that were stolen from his three point-of-sale devices.
"Our clients are restaurants," said Bond's lawyer, Charles Hoff, in a statement. "They are food experts, not technologists. When major players in the hospitality industry such as Radiant Systems and its distributors say their software and business practices are PCI-DSS compliant, our clients trust them."
The class-action lawsuit was filed in October but was not widely known until the privacy blog DataBreaches.net disclosed it last week. Another similar lawsuit was filed against Radiant and Computer World in April by plaintiffs in Georgia.
Citing company policy, a Radiant spokeswoman declined to comment on the lawsuits, but in an e-mailed statement, she said that the company believes that the allegations are without merit. "These customers were victims of criminal acts almost two years ago. Unfortunately, in today’s world criminal acts like these are not uncommon in the restaurant industry," the statement read.
Bond doesn't buy that. "You're buying an expensive point-of-sale system," he said. "But when you're compromised, Visa and Mastercard come after the merchant. There's no level of responsibility with the processor, the reseller or with Visa Mastercard. So the merchant is the person who is suffering."