CheckFree Now Warning 5 Million Customers Over December Attacks

In the wake of last months hacking and subsequent redirect of their website CheckFree has issued a warning notifying more than 5 million customers that they "recently experienced an incident that may have resulted in the infection of certain consumers' personal computers with malicious software."

"The 5 million people who were notified about the CheckFree redirection were a combination of two groups," said Melanie Tolley, vice president of communications with CheckFree's parent company, Fiserv, in an prepared statement. "1.) those who we were able to identify who had attempted to pay bills from our client's bill pay sites and minus those who actually completed sessions on our site; and 2.) anyone enrolled in mycheckfree.com."

According to the original notice filed with the New Hampshire Attorney General (PDF), CheckFree estimated that approximately 160,000 consumers nationwide may have been exposed to the malicious software download attempt. However, the company says it is not possible to determine an exact number of users affected or which specific users attempted to visit the CheckFree sites since those diverted never got there to log in. Therefore they have expanded their notification program to encompass a much broader group of more than five million consumers.

CheckFree came under serious fire shortly after the hacking for not notifying users quickly enough. According to CheckFree's own statements (PDF) the hackers had control of the affected sites for nearly 10 hours before anything could be done to remedy the situation. It took CheckFree narly 5hrs to notify the press or public.