Racing Post website in chaos after hackers raid database

Suspends access while site is secured

British horse racing bible Racing Post has had to suspend member access to its website while it clears up the mess caused by a weekend breach of a customer database.

"The Racing Post apologises for the inconvenience and worry caused to our customers by a malicious attack on our systems," the paper began its notification using the now familiar tone adopted by numerous other sites in the same situation.

The site hasn't specified how many accounts holders have been affected, nor the number of users affected (the physical newspaper has a circulation of between 50,000 and 60,000), but described the attack as "sustained and aggressive."

One database was breached while "we believe others were subject to similar attacks at the same time," the notification said.

The information grabbed depended on the data entered when customers signed up but included first and last name, email and customer address, date of birth and an encrypted password, Racing Post said.

Normal procedure is for sites to advise customers to rest their passwords, but that functionality remains suspended on Racing Post's site "until such time as we are satisfied that it is 100 per cent secure and cannot be breached or accessed in any way by hackers."

"Please do not click on any links in any email purporting to come from a Racing Post address in the meantime," the paper added, clearly aware of the danger of breached account holders receiving phishing emails.

The fact that the paper has yet to reinstate registration and login is a sign of the seriousness of the breach. The site said it was working with cyber security experts to ensure that the hack was not repeated and access would only be allowed when the paper believed the site to be completely secure.

"From what the Racing Post has published thus far the attack appears to be an ever common web application vulnerability that was exploited in order to compromise the database," speculated NCC Group cyber incident response director, Lloyd Brough.

"While it is positive they have been quick to disclose the breach, providing further technical details on what type of encryption was used for the passwords would have helped inform technical users," he said.

"We often see organisations claim encryption where in actual fact they are using hashing via algorithms such as MD5 without salts or iteration counts. If this is the case then it is little better than using unencrypted password due to the trivial nature of recovering them."

There has been a recent rash of online breaches, including that affecting 860,000 users at the MacRumours forum, 42 million at Cupid Media, and perhaps the most significant of all, the 2.9 million account raid on software giant Adobe. Increasingly, these seem occur as part of inter-connected campaigns.

Join the CSO newsletter!

Error: Please check your email address.

Tags Racing PostPersonal Techsecurity

More about Adobe Systems

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E Dunn

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts