ncix NCIX Data breach 2018

[Spykes]

Is there any connection or possibility that this data has been breached and being abused since the bankruptcy? I recall Linus had his phone number compromised.

[Spotty]

7 minutes ago, This_guy1998 said:

Another problem in this case even the employees are/were owed $134,000 CAD according to their trustee https://www.bowragroup.com/bowra-netlink-computer

The problem is not all debt a company owes when it goes under is considered equal. There are different types of creditors.
In that document you link to you can see there are listed "Secured Creditors", "Preferred Creditors" (sometimes called "Priority Unsecured Creditors"), and "Unsecured Creditors". They list the employees as Preferred creditors.

When a company goes in to administration, arrangements are made for any outstanding debts to be paid. If there's not enough available cash to pay the creditors what is own, the assets of the company are liquidated (sold off). Secured creditors get paid first - this will be the banks that have loaned the business money through secured loans. In that document you can see some of the Secured creditors included BMW Canada, Business Development Bank of Canada, Mercedes-Benz Financing, National Leasing Group, Pitney Bowes Global Financial Services, and The Bank of Nova Scotia. Often the administrators will attempt to negotiate the amount owed to secured creditors, because for the banks getting something is better than getting nothing.

 

Then if there's any money left over Preferred creditors, in this case the employees, will be paid out. Generally employees are protected as being classed as Preferred/Priority Creditors, but they still get paid out after the secured creditors.

 

After the preferred creditors are paid, if there is any money left the unsecured creditors will be paid - Unsecured creditors will be companies the business in administration has dealt with and has unpaid debts to, for example from purchasing stock from wholesalers, or contractors hired to build a store, as well as other creditors such as customers that have placed pre-orders and haven't yet received their items or are otherwise entitled to money from the company (ie faulty product refund). The unsecured creditors are usually shit out of luck when it comes to getting any money back in these sorts of situations.

[This_guy1998]

7 minutes ago, robotprobot said:

As a Cyber Security student I am cringing hardcore. 

 

This seems like a complete fuck up by both NCIX before their bankruptcy, and then by the liquidation company afterwards for not checking.

I looked it up around auction time last spring and apparently it's a common thing sadly (who are they going to pay to wipe the data, or when should they wipe it). The reason why this is a big deal just because of the size of NCIX at it's peak and that it's a private company.

[corsairian]

I'd be pissed if this were me. How is this even Legal?

[This_guy1998]

15 minutes ago, Spotty said:

-snip-

I knew that. My point I was making is that they couldn't even afford to pay employees their money, so what makes you think they are going to be able to pay someone to wipe systems. The law doesn't really dictate that well how these systems should be handled when the company goes under. Plus there is value to the inventory/pos system itself (even if it's sucky like in their case), so if they paid anyone to do anything when they closing then it was someone to copy that system (probably without the customer data), so they can sell it. The owner Steve appently knew more about computer systems than business (even though this crap happened, people online claimed he was just careless and lazy). He probably was the one to copy the system over and then just leave the original data. When the trustees take control of the business (they actually went into bankruptcy Dec 22nd, 2017) all the company assets don't belong to company anymore, they belong to the creditor. Then after that the owner (or in some cases a lawyer on behalf of the owner) doesn't have much (if any) responsibility left (they may have to show up to creditors meetings to explain themselves, but why not just send your lawyer and have them fill you in later). As of December 22nd last year NCIX wasn't Steve Wu's problem anymore.

[This_guy1998]

3 minutes ago, corsairian said:

I'd be pissed if this were me. How is this even Legal?

Because the law isn't caught up to this day and age. Plus who are you going to sue if the company went under and supposedly the owner might of left the contiant. Essentially the trustees responsibility is to liquidate assets (both physical and non-physical), pay off debt, and then make sure overall the business is wound down (things like acting as HR, basic Customer service, and such).

[Suika]

So maybe somebody can answer this for me, if I paid through PayPal, would that mean my information is compromised or was the transaction exclusively through PayPal and left me mostly safe?

[This_guy1998]

1 minute ago, Suika said:

So maybe somebody can answer this for me, if I paid through PayPal, would that mean my information is compromised or was the transaction exclusively through PayPal and left me mostly safe?

Your mostly safe. All that was leaked is your email, password, and address

[Suika]

Just now, This_guy1998 said:

Your mostly safe. All that was leaking is you email, password, and address

NCIX account password or PayPal?

[Spotty]

1 minute ago, Suika said:

NCIX account password or PayPal?

NCIX password. Retailers will never see your Paypal password.

However, if you've used the same password for multiple services then you will need to change it.

[Colonel_Gerdauf]

1 minute ago, Suika said:

So maybe somebody can answer this for me, if I paid through PayPal, would that mean my information is compromised or was the transaction exclusively through PayPal and left me mostly safe?

As PayPal acts like a transaction middleman, it does not send any data of it's own. What it does is that it sends the money to the seller of the transaction, and then puts a charge on your account. If you have a credit or debit card, the card will be sent a payment from PayPal. So basically:

When you make a purchase
The seller gets money from PayPal
You will be charged money from PayPal relative to how much you have spent on the transaction

PayPal gets the money from your credit agency

You credit agency is waiting for you to fulfill the bank statement with a file from PayPal

[exetras]

49 minutes ago, robotprobot said:

As a Cyber Security student I am cringing hardcore. 

 

This seems like a complete fuck up by both NCIX before their bankruptcy, and then by the liquidation company afterwards for not checking.

Wait until you get in the industry, its amazing what a lack of resource or pure laziness can make admins and developers do. Also security tends to be a money pit for businesses, so its hard to get the proper resources to do security correctly.

 

Your best tool to get money, resources and training is events like this, use them to scare those that are blocking the changes into submission.

 

Another thing that happens is lack of validation, so someone might have run a tool that encrypts databases, but never verified that it encrypted the correct database or did any changes. This can be due to Lack of training\resources\time or simply doing it because it was required by an audit and they didn't care.

 

I hope someday the IT administration field requires some kind of training\experience validation like the Aviation Mechanics.

[Suika]

8 minutes ago, Spotty said:

NCIX password. Retailers will never see your Paypal password.

However, if you've used the same password for multiple services then you will need to change it.

Alright, cool. Worst case if I forgot to change those passwords, I might lose a smurf account or two if they find those emails, so I should be fine on that front. 

9 minutes ago, Colonel_Gerdauf said:

-snip-

Thanks for the information, I figured that were the case and why I used PayPal, but I wanted to double check before assuming I was in the clear.

[This_guy1998]

11 minutes ago, exetras said:

-snip-

I totally agree will you on that. In a project management class I had, I learned you can have good, fast, cheap and you can only pick two options realistically. In NCIX's case they picked cheap and fast (in the sense that the employees were trained on a system already)?

That's why Cyber Security jobs pay good because to do it right, requires $$$$.

[Lugho]

Anyone read this?

 

https://www.privacyfly.com/articles/ncix_breach/

 

Wonder if there is any of Linus' personal info on there?

[Jackgamer91]

Even though I bought from NCIX in the early 2010s my cards have since expired but I think y'all need to calm down. There are 300,000 people affected by this, of course the third party people who purchased the data will not use everyone's information 1, 3, 5, or even 100/300,000 seems like good odds to me. 

[BlueChinchillaEatingDorito]

3 hours ago, exetras said:

I Shared it with CBC go public.

Watch them ask politicians and Government agencies about what they're doing to prevent this and not get any coherent response back. 

[BlueChinchillaEatingDorito]

8 minutes ago, Jackgamer91 said:

Even though I bought from NCIX in the early 2010s my cards have since expired but I think y'all need to calm down. There are 300,000 people affected by this, of course the third party people who purchased the data will not use everyone's information 1, 3, 5, or even 100/300,000 seems like good odds to me. 

I think the former employees are more in the shits than your consumer. Employers collect data like SIN numbers and bank information for depositing salaries. .

[ThePointblank]

Richmond RCMP has indicated they have the drives:

 

 

 

[This_guy1998]

23 minutes ago, ThePointblank said:

Richmond RCMP has indicated they have the drives:

 

 

 

@LinusTech

[kirashi]

14 hours ago, Spotty said:

14 hours ago, LAwLz said:

Does someone have a list of times companies have leaked or otherwise inappropriately handled user information?

https://en.wikipedia.org/wiki/Lists_of_companies

I see what you did there  Almost snorted my Frappuccino through my nose while laughing too.

[vanished]

49 minutes ago, ThePointblank said:

Richmond RCMP has indicated they have the drives:

 

That's good to know but if the original article is anything to go by, the data has already been copied to god only knows how many others and will continue to spread. 

[TetraSky]

Welp, RIP every employees. Hopefully it won't affect me too much since I paid either through paypal or through bank transfer, so no credit card number was ever given to NCIX... Unless that database also contained bank account numbers and paypal passwords for some reason.
Then again, I had to validate my ID by sending a picture of my Health Insurance Card before(2009)... But I'm pretty sure I blurred out the numbers on it... .... I think... .... And beside they can't do much with that without the SIN.

 

Did these people get arrested or did the RCMP just pick up the hardware?

 

Quote

and data from Mr. Wu’s home computer which featured personal documents and images of his family mixed in with numerous private photos of high end escorts from mainland china. 

So this is where all the NCIX money went, to prostitutes in China. No wonder they went bankrupt. 

[dual290x]

This is scary as hell!

Thank God I never shopped there.

 

 

[ThePointblank]

The BC Privacy Commissioner is now investigating:

 

https://www.cbc.ca/news/canada/british-columbia/rcmp-and-privacy-commissioner-investigate-alleged-ncix-breach-1.4833976