Transparencia ante ataques de seguridad

Ayer se me ocurrió entrar en el blog de la compañía con la que recientemente he contratado un servidor virtual. Esto de los blogs está ya tan extendido que en muchas compañías ya es práctica habitual. Nada más entrar me topo con esto:

A very important update for everyone! It appears that earlier today a third party gained access to our mywebpayment.com billing system. Upon determining that there might be a security breach we immediately terminated the access to everyone by disabling the billing website. At this time we’re still uncertain as to the total scope of the data they accessed. We are going to be as transparent as possible about what happened, what our plans are to correct it, and also how we plan to make sure that this never happens again.

Ups. Nudo en la garganta. La nota sigue:

To start with it appears that the breach was made through some malware/spyware installed on an employee’s office computer. His username and password for the billing system were stored in a document unencrypted on his computer. This information was used to access parts of our billing system that, in retrospect, should have been protected better.

Esos programas que nos descargamos por ahí...

We are certain that credit card numbers were not exposed, however we do know that a limited number of email addresses and plain text passwords were exposed. We highly recommend that if your PayPal password was the same as your Spry password that you immediately change it. While no paypal passwords are ever provided to us, it is likely that many users have chosen the same password for their paypal account and their account at Spry...

Vale. Yo he pagado con Paypal y mi password es diferente, así que aparentemente estoy a salvo, o eso espero.

El caso es que me ha llamado la atención que el ataque haya sido expuesto de forma tan abierta. Por mi parte un diez para ellos por hacer públicos este tipo de ataques, ya que a fin de cuentas seguro que nos ibamos a enterar por otros medios. Siempre es mejor ir con la verdad por delante. De este modo futuros clientes saben que en caso de haber algún problema se sabrá por el blog de la empresa. Ahora bien, tirón de orejas porque el blog no ha sustituido al email, al menos que yo sepa, y no me ha llegado ningún tipo de notificación al correo electrónico.

Quizás es que quieren aumentar las visitas de su blog :)