Mobile postcard and greeting card app Touchnote has suffered a data breach, which has seen the names, email addresses, postal addresses and Touchnote order history of some of its users stolen.
Customers were alerted to the breach in an email from Touchnote CEO, Oded Ran. In the email, Ran reassured users that their passwords had not been stolen, but advised them to change their password anyway.
“Your password has not been revealed, but we recommend you change it now,” said Ran. “We encrypt all passwords and never store them in plain format. For example, if your password was ‘hello’ it will have appeared in our database as a random combination of letters and digits. Nonetheless, as a precaution, we do recommend that you change your Touchnote password immediately.”
Ran added that since Touchnote found out about the incident, it was been working to review all its security measures and update its system infrastructure. The company is also in contact with the National Cyber Crime Unit which is responsible for investigating and finding the perpetrators of such incidents.
He also apologised on behalf of the company, for the data breach. 
Mark Bower, global director at HPE Security, said the breach should serve as a warning to other app developers. “Securing customer data obtained by mobile apps is no different that securing other data – with the available technologies today to easily and quickly protect sensitive data, it’s a proven, reliable way to also protect customer trust and satisfaction,” said Bower. “There’s simply no excuse today not to follow best practices of encrypting all sensitive personal and financial data as it enters a system, at rest, in use and in motion. The ability to render data useless if lost or stolen, through data-centric encryption, is an essential benefit to ensure data remains secure.
“Cyber criminals today are motivated to steal enterprise data, intellectual property and employee or customer information. Hackers are always looking for a way to exploit a system in a way that they can then turn stolen data into cold, hard cash. There is a definite risk if credit card information is obtained. However businesses need to also think about protecting personal information about their customers like name, full address, phone number and email address. Criminals could then use this information to open bogus accounts or sell it for use in more targeted larger-scale spear-phishing or identity theft attacks.
“Beyond the threat to sensitive data, companies need to be concerned with the impact such an event can have on their reputation and, ultimately, on their bottom line. A data-centric approach to security is the industry-accepted cornerstone needed to allow companies to mitigate the risk and impact of cyber attacks and other attempts to get this information.”
