Thousands of credit card numbers were stolen from a state government Web site that allows residents to register their cars and buy state permits, authorities said Friday.
The private company that runs http://www.ri.gov said that 4,118 credit card numbers had probably been taken, a state official said. All online transactions were suspended Friday until any possible security problems could be fixed.
"We just can't risk it," said Department of Administration Director Beverly Najarian.
The company, New England Interactive, originally told state officials late last month that eight credit card numbers were stolen during a security breach, but said Thursday that thousands had probably been taken, Najarian said.
The state didn't notify consumers in December about the breach, Najarian said, because it appeared limited and company officials promised security had been tightened.
Najarian said she did not know why the scope of the breach wasn't detected sooner, and the state will hire an outside consultant to conduct a security review.
State officials have decided to mail notices to the affected credit card holders, she said. So far, no fraudulent charges have been reported.
The breach was uncovered when a security company discovered a Web site in Russian, Najarian said. The author claimed he obtained 53,000 credit card numbers.
Thomas Viall, the Web site's general manager, would not grant an interview to The Associated Press and did not immediately respond to questions submitted by e-mail. But he told The Providence Journal that the Web site was breached on Dec. 28, and far fewer than 53,000 numbers were stolen. He said the company notified credit card companies of the breach, but did not notify card holders.
Jeff Neal, a spokesman for Gov. Don Carcieri, said the company's contract to run the state's Web site expires this summer and the governor's office plans a review before deciding whether to extend it.
Steven O'Donnell, spokesman for the Rhode Island State Police, said a computer crimes team was investigating.
