Federal Police confirm arrest over theft of 60,000 Bottle Domain customer records credit-card details
Federal Police have confirmed that a 22 year old Perth man has been arrested over the theft of Bottle Domain’s entire customer database, including credit-card details.
An estimated 60,000 customer records were stolen, dating back to 2003, with up to 25,000 of the records including complete customer credit-card details.
Even worse, eCommerce Report has obtained convincing proof that the database was being offered for sale on an international hackers web-site.
Following a tip-off from an online forum we joined the hackers site, enabling us take a screen dump of the page seen here. 
It shows convincing proof that the hacker had indeed stolen a database of customer records.
Federal Police have not yet indicated whether or not the database was sold.
But if it was sold, then a major credit-card security breach has been perpetrated and tens of thousands of Bottle Domains customers are at risk.
In response to eCommerce Report enquiries, Federal Police have however, provided details of the charges laid against the hacker, and his initial court appearance.
“The AFP can confirm a 22 year old Perth man was arrested and charged with Dishonestly obtain or deal in personal financial information under Section
480.4 of the Criminal Code Act (Clth) 1995.
The man appeared in Perth Magistrates Court on Tuesday 10 February and was bailed to reappear in court at a date to be advised.
The AFP is working in cooperation with industry stakeholders and the financial sector to investigate this matter.
As this is an ongoing matter it would be inappropriate to provide any further comment.”
The man arrested, who is presumably the person with the tag name of CRiiM on the hackers web-site, says that he first downloaded the customer database seven months ago,
although he didn’t finalise the job until the 27th January this year.
He also says the records concerned go back to 2003.
That suggests anyone who bought a domain name from Bottle Domains in the second half of last year will not be at risk. But anyone who bought a domain name at Bottle Domains before
that may well be at risk.
CRiiM’s postings clearly indicate that a sale price of at least $10,000 and as much as $100,000 was expected.
In fact when other postings on the board suggested the price was too high, and that only perhaps 25,000 of the records included credit card details, CRiiM replied he thought the
price was very low for what was on offer.
He said the database included not only the details of all the Domain Registrars customers (including credit card information) but also domain name registry (i.e.) authinfo keys,
and reseller user IDs and passwords.
The situation has undoubtedly caused considerable concern amongst Australian Internet users and particularly domain name registrars and re-sellers.
Bottle Domains has published an announcement on its web site from Bottle Domains general manager,Andrew Stevens, advising customers to re-set their passwords.
It also claimed that the hack only affected Bottle Domain customers, and that customers of other Australian Style group domain name businesses were not affected.
The announcement said that these other businesses including Bottle, Domain Central and Explorer.Net.
( Although eCommerce Report is aware of at least one other domain name business - Name.com.au – operated by the Australian Style group and not acknowledged in the announcement).
Steven’s announcement appears to have been updated after it first appeared on the 9th or 10th of February, with the addition of a claim that the hacker had formerly been an employee
of a competing Au domain registrar.
Stevens has not been contactable to substantiate his claim but a leading Perth based Au domain registrar contacted by eCommerce Report has denied that any ex-employee of theirs was involved.
However reports out of Perth suggest that the man arrested initially pointed the finger of blame at some one else, who he claimed had previously worked for an Au domain name registrar.
It isn’t yet clear whether Federal Police place any credibility in that allegation.
As we reported in our earlier report on the Bottle Domains hack, the story first came to public attention following a warning announcement published on its web-site by industry regulator
- au Domain Administration Ltd.
For further information go to
www.bottledomains.com.au
www.auda.org.au
| 
