Credit cards sold on 'dark web' for over a year after Saint John parking system hacked

The City of Saint John is beefing up its security systemsin the wake of a breathtaking security breach that left the public's credit card informationwide open to hackers.

In December, the city's information technologystaff learned that for the past18 months, the municipal server for collecting parking ticket fines had been infected with a malwareoutbreak.

It gave hackers access to names, card numbers, card verification numbers, expiry datesand addresses for as many as 6,000 people, who paid their parking fines using credit cards online, in personor over the phone.

On Dec.19, IT World, an online publication, reported the breach of the click2gov software, citing Saint John specifically in the article, even though46 other municipalities across North America were affected.

City wasn't notified of the breach

The story didn't come to the attention of city staff until Dec.21, andby that time the municipality still hadn'tbeen notified by click2gov's manufacturer, CentralSquare Technologies.

The cityshut down the click2gov server halting online payments, but by then sensitive information belonging to card users had already been for sale on the so-called"dark web"for15 months.

• UNB issues warning after faculty emails compromised in massive data dump
• WannaCry conjures up Titanic for N.B. security expert
• Alexa, stop eavesdropping: Cyber experts caution users of smart devices

"Why weren't we notified? Why did we have to find out in an article?" asked Saint John MayorDon Darling at a Monday night council meeting.

"It wouldn't meet my definition of a partnership in the CentralSquare folks, the click2gov folks that we were working with."

Five weeks later, the city's parking fine server remains offline while arrangements are being made with an alternate service provider.

Number of stolen credit cards unknown

In the meantime Stephanie Rackley-Roach, the city's acting director of corporate performance, said the Canadian Institute of Cyber Security will perform a threat assessment on the city's IT systems.

Security measures will be evaluated, antivirus software improved and more robust firewalls will be installed. There will also be further training for IT staff and others who use the system.

The city will also purchase cyber insurance as a precautionary measure.

The city still isn't sure how many credit cards were stolen and later sold. But Saint John police have received 18 complaints since the city issued public notice of the security breach onDec.21.

In an update to its Dec.19 article, IT World reported the cards stolen in the click2gov hack were sold on the dark web for an average of $10USeach.