Paycom Clients Change your FTP Passwords!!!

very very shitty

that's fucked

*how I, and several of their other clients, got hacked (sorry got sidetracked mid-sentence).

Ok, I may have jumped the gun, they are not sure it was Paycom, they are still looking into it... my bad. Will let you know more as I do.

sounds to me like your host needs to lock down your server... if its just ftp issues have them make ftp restricted to ip's.....

Just thought I'd interject here..

We've been tracking an issue a few other hosts have been looking into over the past weeks or so. The common thread essentially is a one-shot successful login to a valid FTP account (e.g. no password guessing, etc.), and adding of some malicious code containing an iframe to various html and php pages.

Currently, at least with our customer base, it appears an external third party may have had a password database compromised. Paycom is just one of a few sources this data could be from, and in Aiko's case that was one biller used. Some unfortunate language was used by an technician in the ticket response, which made it look like we were certain of the source.

The other possibility is a backdoor of some sort (like spyware) going around that may look into FTP software saved passwords.

Anyways, as we know more we will dispense info on to our clients. A good practice for most everyone would be to change any FTP or other account passwords you have given out to any third parties immediately. Also as someone mentioned, if you have the ability to know where you'll always be FTP'ing from, firewalling off everything else provides a good level of protection from leaks such as these in the future.

-Phil

I have a feeling if the source was the processor, there would be a lot more clients who were compomised.
WG

Holy crappers, that's bad...

hmmmm not good at all

that's not good news

Doesn't mean Paycom was hacked... Could mean you are leaving the info open or the FTP software itself is hackable.