The put up a notice on their website now: https://www.computerlounge.co.nz/main/security-updates.asp

Now that the cops and forensics are involved and they are trying to determine the 'extent of the data leaked', I definitely wouldn't want to be one of the people that were fiddling around with the site after reading about it

Shame their ssl cert expired at midnight. You'd think they might have checked all that before coming back online!

nzkc:

 

Shame their ssl cert expired at midnight. You'd think they might have checked all that before coming back online!

 

 

Their website seems to be working for me fine..last night and this morning. 

nzkc: Yep, it's fixed now. Was definitely expired last night. Maybe a bit slow on auto renew

I still wouldnt use it...thinking of changing my credit card just in case. Lost all confidence as apparently they have known about this flaw for a long time. 

nzkc: Yep, it's fixed now. Was definitely expired last night. Maybe a bit slow on auto renew

They're now using LetsEncrypt. I don't have confidence they've fixed the issue - they've had security issues in the past, whats to say the issues are not still there?

Not even accepting a connection now....

Never mind, just took an incredibly long time to do anything, now its loading pages fine.

michaelmurfy:

 

nzkc: Yep, it's fixed now. Was definitely expired last night. Maybe a bit slow on auto renew

 

They're now using LetsEncrypt. I don't have confidence they've fixed the issue - they've had security issues in the past, whats to say the issues are not still there?

 

I don't understand why they havnt stated if they have corrected the holes that were in their old site? Surely their customers (including myself)want reassurances before using the site again. I have noted that I am auto logging into the site still as was the case previously. I did expect to form a new password.

Their response continues to be unacceptable to me.

• They haven't actually confirmed if they have fixed the vulnerability.
• They haven't proactively contacted any customers to tell them.
• They are claiming they have done everything in their power to "right this wrong", but I'd say ignoring the issue for 6 months, then burying their head in the sand for days is hardly doing that.

I've both used them myself and recommended them to many people over the past decade, and I'm really starting to deeply regret that. Their response to this to date has been utterly unacceptable, and sadly continues to be so.