Bowker’s ISBN SIte Has Been Hacked, and Credit Card Numbers Have Been Stolen
When I reported 3 days ago about MyIdentifiers.com’s extended downtime, I made an offhand reference to a report about credit cards being stolen on the site. I didn’t really trust that unconfirmed story, but it was later confirmed by another author, and now Bowker admitted that due to their sloppy website security, they were indeed hacked.
Bowker was recently made aware by the payment card networks of patterns of unauthorized charges occurring on cards after they were legitimately used on Bowker’s website, www.myidentifiers.com. We immediately launched an investigation and engaged a leading forensic firm to assist. Our investigation has identified unauthorized code that was added to the checkout page on our website. Based on currently available evidence, our investigation is focused on determining if the code was active from May 1, 2018 through October 23, 2018. However, because our investigation is continuing, complete findings are not available and it is too early to provide further details on the investigation. We anticipate providing notification to any affected customers as we get further clarity about the specific timeframes and orders that may have been affected.
Bowker has not said when their site will be online again, but they did say that you can still buy a single ISBN through a different site. You can also buy a block of ISBNs by downloading an order form and faxing it in.
BTW, did anyone else notice they didn’t tell anyone about the hack until two days after I first reported it? Does anyone else think they would never have said anything publicly if I hadn’t already posted my scoop? (I do)
P.S. This is why I continue to blog; I love being two days ahead of the official announcement.
Angela Korra’ti November 2, 2018 um 10:18 am
Well, damn. I had a credit card get compromised a few weeks ago. AND I did buy a new block of ISBNs for my work. I think this may be the vector through which the compromise happened. :[
Nate Hoffelder November 2, 2018 um 10:24 am
So you still haven’t gotten an email? Wow. They are really trying hard to avoid telling people.
Angela Korra’ti November 3, 2018 um 12:54 am
Yeah, your post is the first I’ve heard of this. This does not make me inclined to want to do business with these people in the future. >:|
Nate Hoffelder November 3, 2018 um 5:01 am
The IBPA also covered it, but yeah, there has been a lack of notice from Bowker.
Lori Shandle-Fox November 22, 2018 um 5:54 pm
Hi Nate, any updates with this bowker fiasco? incredibly frustrating. I’ve called, faxed, and emailed over the past 2 1/2 weeks. no info. no isbns.
Nate Hoffelder November 22, 2018 um 7:44 pm
Nothing yet, sorry.
Will Entrekin November 2, 2018 um 10:27 am
"you can still buy a single ISBN through a different site. You can also buy a block of ISBNs by downloading an order form and faxing it in."
Or you can still just avoid them altogether for ebooks, because as far as I know there’s still not a single major digital retailer (Amazon, Apple, Kobo, B&N) who requires them.
Lori Shandle Fox November 22, 2018 um 6:00 pm
still waiting (2 1/2 weeks and counting) for a reply to my fax. emailed, sent a follow up fax, called… all to no avail. if you’ve heard any updates do tell.
Brian T November 2, 2018 um 12:06 pm
This might be the type of hack they are talking about if someone wanted more information: https://arstechnica.com/information-technology/2018/09/british-airways-site-had-credit-card-skimming-code-injected/
Allen F November 2, 2018 um 12:31 pm
So glad I never bothered paying their prices for a number.
S Marcus November 3, 2018 um 5:28 pm
Does that mean that the block of ISBNs I bought in March 2018 is compromised?
Nate Hoffelder November 3, 2018 um 5:34 pm
The credit card you used may be compromised, yes.
PJ Harrison November 4, 2018 um 4:52 pm
I’m so glad I am cheap. Every time I look at their price tag, I decide not to. It’s reinforced by the fact with Temp Residency, I can get my ISBNs in Mexico for 13 bucks each [less depending on the value of the peso that day]. So it simply gets put off until I relocate.
Alicia Butcher Ehrhardt November 4, 2018 um 6:06 pm
I’d say congratulations on the scoop, except that even you would have rather had it up front.
I only hope enough people will see this – bad on Bowker. Long may they not live.
Laura November 12, 2018 um 11:27 am
No notice to this major publisher yet either…
Amy Gaiennie November 13, 2018 um 1:50 pm
Shortly after purchasing a barcode from Bowker recently, the credit card I used was hacked. Payments went to a site in Hong Kong. This is probably the Bowker hacking.
Angela Korra’ti November 25, 2018 um 8:54 pm
Followup on this post, for those of you who like me might have been impacted:
As of this weekend (mail received on Saturday the 24th, though I am writing this on Sunday the 25th), I FINALLY received mailed notice from Bowker that my credit card might have been impacted by the hack to their site.
Given that Nate posted this posted back on 11/2, that’s an elapsed turnaround time of about three weeks.
However, I found out about our credit card being compromised back on September 22nd, which is when I first posted to Facebook about it. So counting from there, that’s just over two months between when I found out about the card being compromised–and Bowker finally sending me notification that a hack to their site might have put my card at risk.
GEE THANKS BOWKER. Bit late there. >:|
All of Barnes & Noble's Computer Systems Are Down, and I do Mean All of Them | The Digital Reader October 13, 2020 um 10:36 am
[…] we recall from the Bowker hack in 2018, sometimes the first public evidence of a hack is bogus credit card […]