Barnesandnoble.com Inc. has reached an agreement with New York Attorney General Eliot Spitzer to fix an Internet security breach that exposed the personal information of some of the online bookseller's customers, Spitzer's office announced Thursday.
Under the terms of the agreement, Barnesandnoble.com will pay $60,000 in costs and penalties and establish an information security program to protect personal information; establish management oversight and employee training programs; and hire an external auditor to monitor compliance with the security program.
The agreement follows an investigation into the company's privacy and information security practices.
During the investigation, Spitzer determined that a design vulnerability in Barnesandnoble.com's Web site permitted unauthorized access to consumers' accounts and personal information, and enabled users to make purchases on the site using other consumers' accounts, according to Ken Dreifach, chief of Spitzer's Internet bureau.
"The investigation began in 2002 when a number of good Samaritans notified us of the fact that they were able to inadvertently get into other consumers' accounts, order books or other items from another person's account and view that person's purchasing history," Dreifach said.
Barnesandnoble.com CEO Marie Toulantis said the company cooperated with the investigation and fixed the problem very early on.
"No one's credit card was ever exposed," she said. "I can count on one hand the customer complaints about this."
Reuters contributed to this story.