Registrar's database said to have exposed data

A database problem with a major US domain registrar exposed sensitive financial and personnel information.

A database problem with a U.S. domain name registrar exposed sensitive financial and personal information relating to thousands of domain name registrations, a Dutch company said Friday., of New York, fixed the problem shortly after being notified Thursday, said Nico Vandendries, chief executive officer of Strongwood, a private investigation company based in the Netherlands. Chief Executive Officer Alex Brecher said that the company is 100 percent positive customer data was not compromised. The "alleged vulnerability," he wrote, was patched within minutes after the company was contacted by Strongwood.

"We're in the midst of investigating these allegations, and we cannot provide detailed information at this time," Brecher wrote.

Erik Ekkelenkamp, a system project engineer with Strongwood, was researching .eu domain names when he clicked a link within DiscountDomainRegistry's site. The link led to an error involving execution rights on a MySQL directory. MySQL is a widely used open-source database program.

A script plus other programming usually unseen was visible that allowed for a connection to the database, which contained credit card numbers, usernames, passwords and other information, Vandendries said.

A official wasn't initially convinced there was a problem, Vandendries said.

"At first, they didn't believe us until we presented him with his own password," Vandendries said. "And then he knew we were in."

On its Web site,, founded in 1998, says it registers domain names for US$14.99 per year, including those of Fortune 500 companies.

So far, it's believed no one has exploited the error, which may have existed for up to four months, Ekkelenkamp said. had changed parts of its Web site recently, which may have resulted in the bug, he said.

The damage could have been severe, Vandendries said. The credit card data and personal information from clients could have been sold, he said.

Further, access to usernames and passwords would have allowed an intruder to change the names and IP (Internet Protocol) addresses associated with Web sites, a method used for so-called "phishing" scams, Vandendries said.

Phishing involves tricking users into visiting a Web site that appears legitimate but actually is a facade. The URL (uniform resource locator) may look authentic but connects to an IP address with a bogus Web site.

The fraudulent Web sites usually have forms for providing sensitive material, such as financial information, which is then directly sent to scammers.

Vandendries estimated it would take "little skill" with MySQL to exploit the bug. "If a bad guy found this leak and had access to the database ... then I'm sure it could have cost millions."

Ekkelenkamp said he received a call last night from the owner of thanking him.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

D-Link TAIPAN AC3200 Ultra Wi-Fi Modem Router (DSL-4320L)

Learn more >

D-Link PowerLine AV2 2000 Gigabit Network Kit

Learn more >

Crucial® BX200 SATA 2.5” 7mm (with 9.5mm adapter) Internal Solid State Drive

Learn more >

Xiro Drone Xplorer V -3 Axis Gimbal & 1080p Full HD 14MP Camera

Learn more >

ASUS ROG Swift PG279Q – Reign beyond virtual world

Learn more >

Gadgets & Things

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >


Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

ASUS VivoPC VM62 - Incredibly Powerful, Unbelievably Small

Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Stocking Stuffer

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Best Deals on PC World

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?