Do We Need a New Internet?

In yesterday's New York Times, John Markoff writes that maybe we need a brand new Internet.  This time with security...  I allude to this article with the sole intent of bringing into perspective, why HomeATM has chosen to take a hardware-based (outside of the browser space) end-to-end encrypted approach to e-transactions.  

Here are some selected quotes:

• "Bad enough that there is a growing belief among engineers and security experts that Internet security and privacy have become so maddeningly elusive that the only way to fix the problem is to start over."
  
  
• The Internet’s original designers never foresaw that the academic and military research network they created would one day bear the burden of carrying all the world’s communications and commerce. There was no one central control point and its designers wanted to make it possible for every network to exchange data with every other network. Little attention was given to security. Since then, there have been immense efforts to bolt on security, to little effect.
  
  
• “In many respects we are probably worse off than we were 20 years ago,” said Eugene Spafford, the executive director of the Center for Education and Research in Information Assurance and Security at Purdue University and a pioneering Internet security researcher, “because all of the money has been devoted to patching the current problem rather than investing in the redesign of our infrastructure.”
  
  
• Despite a thriving global computer security industry that is projected to reach $79 billion in revenues next year, and the fact that in 2002 Microsoft itself began an intense corporate-wide effort to improve the security of its software, Internet security has continued to deteriorate globally.
  
  
• Even the most heavily garrisoned military networks have proved vulnerable. Last November, the United States military command in charge of both the Iraq and Afghanistan wars discovered that its computer networks had been purposely infected with software that may have permitted a devastating espionage attack.

To read the NYT article in it's entirety, click here

Related articles by Zemanta

• Thieves Winning Online War, Maybe in Your PC (John Markoff/New York Times) (techmeme.com)

$1 Trillion Lost to Cybercrime...Can Hackers Bail US Out?

According to the numbers provided in recent report from McAfee, maybe we should be asking the hackers, instead of US taxpayers to bail us out of this recession. 

McAfee, in a recent report entitled, "Unsecured Economies: Protecting Vital  Information, states that data theft and breaches from cybercrime may have cost businesses as much as $1 trillion globally in lost intellectual property and expenditures for repairing the damage in 2008.

McAfee made the projection based on responses to a survey of more than 800 chief information officers in the U.S., United Kingdom, Germany, Japan, China, India, Brazil, and Dubai.

The respondents estimated that they lost data worth a total of $4.6 billion and spent about $600 million cleaning up after breaches, McAfee said.  McAfee CEO Dave DeWalt spoke to CBR about the results and said that the findings suggested the figure around the world could be much larger.

“The findings are startling,” he said. “We believe the potential figure for total losses worldwide could be as much as $1,000,000,000,000 trillion.”

 In what has to be one of the dumbest mindsets/perceptions out there, the survey also found that respondents worried more about the damage that leakage or loss of  vital information would do to their company’s reputation than about the financial impact.  That statement would lead me to respond that if they're more worried about their company's reputation than financial impact, then they should donate all of their gross revenues to the bailout fund.  That would help their reputation as far as how US taxpayers would perceive them.   C'mon. 

The financial impact of a breach could potentially destroy a company...let alone their reputation.  Of course there "may" be exceptions, for instance,  Kapersky, (now more famoulsy known as "KaperSkyisFalling") F-Secure (who knew that the F stood for Failure) and BitSecure.  (are they contemplating rebranding their company as: "A BitMoreSecure?") whom all were recent victiims of the same Romanian hackers SQL Injection/cross site scripting attack which allow him to gain access to key data.  They have to worry about their company's reputation because they're supposed to "provide security."  On the other hand, ask Heartland Payment Systems if they're more worried, at this point, about their reputation or the financial impact of the breach.

Not surprisingly, McAfee's DeWalt said "that kind of mindset (reputation first, financial impact later) could be very damaging to enterprises."  Asked if he felt companies did not fully understand the value of IP, he said: “Yes, it’s all about brand protection, but that is after the fact. Businesses need a much better understanding of what data they have and where it is stored.” He added that a combination of education, technology and government intervention is they key to improving data security.

"This is the number one security concern at the moment."  McAfee suggested that situation could get worse as businesses are put under increasing pressure to reduce costs during the economic downturn. Reduced spending and staffing levels have led to more porous defenses and increased opportunity for crime," DeWalt said.

China's Credit Card Market - 2008 Report Available

Description

After five consecutive years of growth since 2003, China's credit card market finally started its adjustment in 2008. And since the beginning of the second half of that year China's banks have been cutting their issue of credit cards because the global financial crisis and the degradation of international credit market and thus that banks needed to control risks.

As a result, the increase of issue of credit cards was down more than 50% from a year ago. But the absolute number of credit cards still went beyond 150 million in China in 2008 in spite of the slowdown of issue.

The major credit-card brands in China include: China UnionPay, VISA, MasterCard, American Express, and JCB. 

The market shares of which were UnionPay 64.6%, VISA 18.0%, MasterCard 15.2%, American Express 0.7%, and JCB 1.6% by the end of November 2008. (see graphic on left)

To view the "Table of Contents" from the report, click the link provided below:

2008 Report on China's Credit Card Market TOC - PDF

Wyndham Hotels Hacked...Cards Compromised

Hack Alert

This is getting a little ridiculous is it not? Every week there's a new hack.  This time you're being warned that if you stayed at a Wyndham Hotels and Resorts property last year that you may want to monitor your credit card statements  They are the "latest" victim, for lack  of a better word, of a data breach which has compromised payment card information.

Here's the Press Release
Press Release
February 16, 2009

To our Wyndham Hotels and Resorts guests:

In mid-September, 2008, our company discovered that a sophisticated hacker penetrated the computer systems of one of the Wyndham Hotels and Resorts (WHR) franchised hotels. By going through the centralized network connection, the hacker was then able to access and download information from several, but not all, of the other WHR properties and create a unique file containing payment card information of a small percentage of our WHR customers. The incident did not affect any of the other branded hotels in the Wyndham Hotel Group system. We deeply regret that this incident occurred and are doing everything we can to notify our customers directly, to address and remedy the problem, and, more importantly, to ensure that it does not reoccur.

CLICK HERE FOR FAQS ABOUT THE INCIDENT.

In addition to ensuring that the hack was immediately terminated and disabled, we promptly retained a qualified investigator to assess the problem and ensure that we had isolated it, and then to help us implement the proper changes to strengthen and improve the security of our connections with each of our WHR branded properties. Further, each of the impacted properties separately brought in a qualified PCI investigative firm to assess and improve the security at each hotel property in the system.

To ensure our customers’ card numbers were protected, we provided each of the payment card companies (American Express, Visa, Mastercard and Discover) with the actual card numbers that were accessed so that these payment card companies could take such action as they deemed appropriate to monitor the use of the cards.

We also notified the Secret Service, as well as several states' attorneys general offices with information about the breach, and continue to work with law enforcement to assist in the investigations of this matter.

Because only payment card information was compromised, we had difficulty locating the names and addresses of the individual customers’ impacted. Undaunted, we contracted with secure third party consumer reporting agencies to match every active credit card in the United States with the consumer’s name and address and we personally provided notice to those individuals.

CLICK HERE FOR A COPY OF THE CONSUMER LETTER THAT WAS DELIVERED TO EACH IMPACTED CONSUMER.

Potentially exposed through this breach are guest and/or cardholder names and card numbers, expiration dates and other data from the card’s magnetic stripe. At this time, no criminal identity theft related to the use of the consumer data has been identified. Importantly, we believe that it is unlikely that identity theft will occur because of the limited amount of information that was compromised. Birthdates, SSNs, addresses or other personally identifying information were not kept by the hotels and therefore not part of the compromise. Nevertheless, we recommend that you regularly monitor your card and bank statements and that you promptly report all suspicious activity to the financial institution that issued your card.

CLICK HERE FOR A DESCRIPTION OF ACTIONS YOU CAN TAKE TO PROTECT YOUR CREDIT.

Wyndham prides itself on providing exceptional value for our guests. We deeply regret this incident occurred and we will work hard to restore your confidence in our brand.

Sincerely,

Kirsten Hotchkiss

Airmiles...Use 'em or Lose 'em

Credit card holders could lose their Airmiles

Millions of people face losing all the Airmiles they have collected through buying with their credit cards and shopping online if they fail to collect any in the next six months.

Airmiles – the UK's longest-running loyalty programme – has written to 1.7 million customers who have 500 Airmiles or more but have not collected any in the past two years, telling them that if they do not collect at least one Airmile in the next six months, their accounts will be closed and they will lose any Airmiles they have accrued.

The company's actions have angered customers, and Simon Calder, the Independent's travel editor likening the move to banks closing savers' current accounts through lack of activity.

Mr Calder told the BBC: "That's a bit like having a bank account where you're told, 'Ah, well, you haven't put any money in it for a couple of years so we've closed it down and kept your money.'"

Continue Reading at Fair Investment

Related articles by Zemanta

• The Steady Ascent of the Debit Card (businessweek.com)

Another Payment Card Processor Hacked

Anthony Freed, Financial Editor for Information Security Resources writes, in an excellent article, that there are reports that another Payment Card Processsor has been hacked.  The company has not yet been named, but "multiple tips from multiple sources" claim that another processor, other than Heartland is behind recent warnings to banks about potentially having to replace consumer cards.

Developing... 

Another Payment Card Processor Hacked 

By Anthony M. Freed, Information-Security-Resources.com Financial Editor

Reports are surfacing that there has been another major information security breach at a credit card payment processor, though the company has not yet been identified.

The breach news comes less than one month after Heartland Payment Systems announced they had suffered what is likely to be the biggest PCI breach to date, possibly bigger than the TJMAX breach.

Heartland (HPY) is the sixth largest payment processor in the nation.

There had been indications in early Heartland reports that the FBI was pursuing suspects who may be part of a larger criminal conspiracy targeting multiple companies, but there are no reports yet as to whether this latest breach is part of that investigation, or whether the revelations at Heartland led to this breach being uncovered.

From DataLossDB.org on the breach at the unknown company:

Banks around the country are reportedly receiving warnings, and perhaps even new lists of cards to replace. This is apparently regarding another credit card processor, unrelated to Heartland Payment Systems, having a significant breach.

OSF has received multiple tips from multiple sources, and has spoken with the good people over at bankinfosecurity.com who have confirmed they too are hearing the exact same thing. From what we’ve heard, this second breach is significant in scale, but we have not as of yet been told who the processor is.

Also, speaking of BankInfoSecurity.com, they’ve released an article about three people being arrested for allegedly using credit cards from the Heartland Breach. And also, their list grows of institutions affected by the Heartland incident (they maintain a much more comprehensive list than we did). Hats off!

Our team has been predicting that 2009 will be the year that InfoSec moves to the forefront of the economic crisis. We believe the somewhat obscure issue will be as familiar to the American public as the notorious subprime and pay option ARMs have in the last year or two.

Much like the meltdown of the mortgage industry, the revelations of lax governance in the handling of sensitive and private data will likely shock the public and the business community alike, and those revelations are bound to come all too painfully slow, especially for shareholders.

The data loss debacle at Heartland highlights the fact that the failure to secure information is the next major shareholder derivative, director and officer liability, regulatory, consumer product safety, and class-action issue to impact our economy.

Nearly one month after going public, few details of the Heartland breach have been released, and many questions remain regarding a long chain of events that include both the breach and also an aggressive executive 10b5-1 stock selling plan adopted in early August of last year, the same month the breach is now reported to have ended, but still five months before the breach was announced publicly.

Heartland Payment Systems stock price has been flat-lined since losing half of it’s value shortly after the January 20, 2009 breach announcement. A report form komonews.com gravely illustrates that this is more than a security issue, it is a commercial viability issue:

Heartland says it has closed the security hole that allowed criminals to infiltrate their systems, but the matter is far from settled. The company will likely have to pay big penalties to banks to reimburse the cost of issuing new cards, and analysts say the intrusion could even threaten the company’s survival if the big card brands decide to cut off Heartland from connecting to their networks.

One big payment processor, CardSystemsSolutions, went under after a 2005 data breach in which 40 million credit card accounts were compromised and the big card brands stopped doing business with CardSystems. Representatives for Visa Inc. and MasterCard Inc. declined to comment.

The latest piece of news for the Heartland timeline comes from StorefrontBacktalk.com’s Evan Schuman:

“According to a MasterCard alert, this sniffer program stole card numbers and expiration dates from credit and debit cards processed by Heartland from May 14, 2008, through Aug. 19, 2008, as the information entered Heartland’s payment switch,”

Here is what we know of the Heartland timeline thus far, which is not much, but it does beg for a more thorough explanation by company officials for no other reason than several important things happened in a relatively short period of time, and that alone should be reason enough:

May 14, 2008: Breach reported to have began
May 20, 2008 Carr Makes first stock sale of the year, 2695 shares
August (first week), 2008: CEO Robert Carr’s 10b5-1 is proposed
August 8, 2008: Board approves 10b5-1 plan
August 8 - August 14, 2008: Carr makes six separate sales of stocks totalling 60,000 shares
August 19, 2008: Breach reported to have ended
August 28, 2008: Carr sells 80,000 shares
September 3, 2008: Carr sells 80,000 shares
September 17, 2008: Carr sells 80,000 shares
October 15, 2008: Carr sells 80,000 shares
October 28, 2008: Visa and MasterCard notify Heartland of problems; Carr sells 80,000 shares
November 6, 2008: Carr sells 80,000 shares
November 20, 2008: Carr sells 80,000 shares
December 11, 2008: Carr sells 80,000 shares
December 26, 2008: Carr sells 42,900 shares
January 7, 2009: Carr sells 80,000 shares
January ??, 2009: Carr suspends his 10b5-1 stock selling plan
January 20, 2009: Breach Announced

HeartLand representatives maintain that company officials were not alerted to the breach until being contacted by Visa (V) and MasterCard (US:MA) officials in late October.

In an email I received from Heartland’s representatives, they state that there is no relationship whatsoever between the breach and Carr’s stock sales:

At the time of this announcement, Mr. Carr was not under any trading restrictions pursuant to the company’s insider trading policy and was not in possession of any material non-public information concerning the company. Under this 10b5-1 plan, programmed sales of company stock were made on Mr. Carr’s behalf, and he had no discretion regarding the timing or other aspects of those sales.

Although he was not required to do so, Mr. Carr terminated his 10b5-1 when the company confirmed the security breach it disclosed in the company’s press release of January 20, 2009. As has been reported, Heartland first learned of a potential problem from the card associations on October 28th of last year, well after the announcement of this 10b5-1 plan. Heartland categorically denies that Mr. Carr was aware of a potential security breach at the time he adopted his trading plan.

I can see no reason not to take them at their word, but I also urge Heartland officials to release more information to clear up the issue, such as the documentation that Heartland’s Systems and IT departments keep to show compliance with requirements for sensitive data protection. Hard copy confirmation that no one at Heartland was aware of any major security problems prior to October 28, 2008 would put any questions to rest with more finality than a corporate press release or an email.

Something to look forward to is the conference call with Carr now scheduled to take place in the last week of February. The agenda state the call will discuss Q4-2008 earnings, but it seems almost certain they will address the breach then, and hopefully will provide more details regarding an eventful August 2008.

From the press release:

Chairman & Chief Executive Officer Robert Carr and President & Chief Financial Officer Robert Baldwin will host a conference call beginning at 8:30 AM Eastern Time, Tuesday, February 24, 2009, to discuss fourth quarter and fiscal year end 2008 results and conduct a question and answer session.


Heartland Payment Systems invites all interested parties to listen to its conference call broadcast through a webcast on the Company's website. To access the call, please visit the Investor Relations portion of the Company?s website at: www.heartlandpaymentsystems.com. The webcast will be archived on the Company?s website within two hours of the live call and will remain available through Friday, May 22, 2009.


You may also participate by calling (800) 559-6679 and providing the operator with Pin Number 81829786

The SEC does require disclosure by company leadership of known threats to share price, so we should expect that more will be revealed during the call - unless the investigation would prevent the release of such information, in that case we would probably at least get some statements to that effect.

Either way it seems that much will be revealed in the call.

As for the latest breach, let’s hope it is not a record breaker and that no fraud cases are the result. Be vigilant about checking your own credit card statements and report any suspicious activity immediately. Then just keep your fingers crossed that we can effectively put the information security genie back in the bottle before the next breach is not just a financial security matter, but a national security event as well.

Anthony is a researcher, analyst and freelance writer who worked as a consultant to senior members of product development, secondary, and capital markets from the largest financial institutions in the country during the height of the credit bubble. Anthony’s work is featured by leading Internet publishers including Reuters, The Chicago Sun-Times, Business Week’s Business Exchange, Seeking Alpha, and ML-Implode.

Week in Review

• Canadians Spending More Online
• Visa Showcases Mobile Payment/Money Transfer
• PCI Compliance May Benefit Heartland - cardline
• Web Retailers Post Solid Quarterly Sales
• First Arrests in Heartland Breach
• Paraskavedekatriaphobia
• Japan, Turkey and (Kenya?) Lead Mobile
• How Many US Internet Users Are There?
• HomeATM Uses E2EE...But What is End-to-End-Encrypt...
• Instant Card Issuance For Breaches?
• Arab Nat'l Bank Selects Postilion
• Dangerous Vulnerability in Blackberry
• Security Fears Stunt Growth, HomeATM Stunts Securi...
• RIM to Buy Certicom Encryption Maker
• Voltage SecureData Now Provides E2EE
• Gemalto and INSIDE Contactless Announce NFC Availa...
• Online Generation Gap - Pew
• Web Only Retailers See 24.9% Growth
• Poll: Only 4% of Banks Unaffected by Breach
• Visa Issues PIN Attack Security Alert
• MasterCard Latin America Sees Strong Growth
• Recent Debit Scam Source in Canada ID'd
• Nigeria Leads Blocked eTransaction List
• HomeATM Client Continues Growth with PIN Debit
• 150+ FI's Affected by Heartland Breach...and Count...
• RBA Gives PayPal Double Whammy
• Another Day Another Hack - FAA Breached
• Taobao - China eTransaction Volume up 131%
• $37 Billion Savings if You PrePay?
• How to Hack an ATM
• Data Security Summit Host Says Don't Type...Swipe!...
• PayPal Says Don't Type...Swipe
• CashEdge Executes $50 Million in Online Transfers
• Less Than Half Strongly Support UAE's Move to Chip...
• Hacker Breaches Kapersky - Dark Reading
• InterSwitch Introduces Africa's First Chip and PIN...
• January E-Commerce Shows Some Bright Spots
• Mazooma Launches Alternative Payment
• New Payment Rules Before Parliament
• HomeATM Client UATP Unveils New Website
• Comments Have Been Enabled on the HomeATM Blog
• M-Cube Offers Prepaid Mobile Banking
• Surprise! ID Theft on Rise
• Sorry Noca...NoCanDo
• On Visa, Barclays and Heartland
• Internet Growth Could Double Shares of Payment Pro...
• Video: Debit Card Thefts on Rise - Consumer Report...
• Heartland Breach Won't "Disappear"
• Strengthen Security of Online Payments - European ...
• Amazon Payments Taken Out of Beta
• Mobile Money Transfer Gaining Acceptance
• X-Force Is With You...
• Parking Ticket = Malware in Disguise
• UATP Processes Record $12 Billion in 2008
• Paradigm Shift E-vidence Continues to Stack Up

Canadians Spending More Online

Online business analyst eMarketer reported that Canadian retailers would sell an estimated $15.5 billion Canadian worth of goods and services in 2008, up some 12.4 percent from 2007's total of C$13.8 billion.

By 2012, Canadian ecommerce sales should reach C$22.8 billion, including travel sales, digital tickets, and digital products like software. In spite of this projected growth, Canadian's still trail their U.S. consumers in terms of purchasing online, according to a new study from eMarketer.

"Consumers in Canada are avid online product researchers, on par with their US counterparts. But they are much more likely to make a subsequent purchase in-store rather than on a Website," said eMarketer on its website.

Related articles

• B2C E-Commerce in Canada - 2007-2012 (pindebit.blogspot.com)

Visa Showcases Mobile Payment/Money Transfer

Visa showcases mobile payments, money transfer, payment services at 2009 Mobile World Congress

London and San Francisco, Feb. 13, 2009 -- Visa Europe and Visa Inc. (NYSE: V - News), the world's largest retail electronic payments network1, will be showcasing the latest innovations in payments at the 2009 GSMA Mobile World Congress. In addition, Visa executives will discuss how Visa is helping to drive the convergence of financial services and mobile technology.

Visa will use real life examples to demonstrate how its innovations in mobile payment technologies can enhance consumers’ daily lives, providing speed, convenience, security and choice.

Visa mobile product demonstrations will include:

• Visa Mobile on Android: In December, Visa launched the first commercial service in the U.S. that provides mobile offers, transaction alerts and a locator service. Visa Mobile is available on mobile devices powered by Android, including the T-Mobile G1™ phone.
• Mobile Visa payWave: Secure mobile point of sale payments using Visa payWave embedded in a mobile device. Visa will demonstrate both NFC-based and SIM-based contactless payments.
• Mobile Money Transfer: A demonstration of handset-to-handset and online-to-handset money transfer.
• Mobile Transaction Alerts: Near real-time notification of card purchase activity delivered to the mobile device.
• Mobile Offers: Targeted offers and coupons delivered directly to the mobile device and redeemed at near-by merchants.
• Mobile Merchant: Convenient cashless transactions on the move. Mobile merchants, such as a pizza delivery service, can accept Visa payments with the help of enhanced mobile handsets that double as a mobile acceptance device.
• Smart Poster: Co-branded mobile posters, signposting nearby coffee shops with the offer of exclusive mobile ‘buy one, get one free’ offers.

The Congress is the key global conference and exhibition for the mobile industry and is sponsored by the GSM Association (GSMA). It attracts more than 1,200 exhibitors, and more than 50,000 visitors including key Visa clients and vendors from around the world.

Visa executive speakers at the Mobile World Congress 2009 include:

• Kelly Alpert, Head of Money Transfer Initiative, Visa Inc.
• Mary Carol Harris, Head of Mobile, Visa Europe
• Guido Mangiagalli, VP, Visa payWave and Mobile, Visa Europe
• Pam Zuercher, Senior Business Leader, Product Innovation, Visa Inc.

Source: Company press release.

mobile world congress, Visa, p2p,

Related articles by Zemanta

• Mobile Handsets NFC Enabled by 2010? (pindebit.blogspot.com)
• TechCrunch Roundtable At Mobile World Congress: Mobile 2.0 - Where Next? (tsurch.com)
• We're off to Barcelona (mobilecrunch.com)
• Samsung delays its Android phone (phonemag.com)
• Symbian Foundation endorsed by Qualcomm, SanDisk, MySpace and more (allaboutsymbian.com)
• Gigafone and Xtract partner to create a superior mobile marketing platform (andrewgrill.com)
• Samsung dashes hopes for 12 megapixel phone at MWC (engadget.com)

PCI Compliance May Benefit Heartland - cardline

CardForum | PCI COMPLIANCE MAY BENEFIT BREACH-SUIT DEFENDANTS

PCI COMPLIANCE MAY BENEFIT BREACH-SUIT DEFENDANTS

Reported compliance with the Payment Card Industry Data Security Standard could help Heartland Payment Systems Inc. defend itself against class-action lawsuits filed in the aftermath of its reported card-data breach, according to Ronald Mann, a professor of law and co-chair of the Charles E. Gerber Transactional Studies Program at Columbia Law School.

Since Heartland announced the breach Jan. 20 (CardLine, 1/20), consumers have filed at least three lawsuits alleging the Princeton, N.J.-based merchant processor violated the Fair Credit Reporting Act and a variety of state data-breach notification and consumer-protection laws (CardLine, 1/29).

Plaintiffs could have difficulty proving the breach harmed them, given that, besides some cardholder names, the only breached information appears to have been card data, Mann says. Clearing fraudulent transactions from a card account can be a hassle for consumers, but issuers tend to cancel cards or reimburse cardholders for fraudulent transactions, he says. "In previous litigation in this area, class-action suits against the hacked merchant have suffered from the problem that the likelihood of identity theft or of substantial harm depends a great deal on the particular circumstances of the victims and of their card issuers," Mann says.

Web Retailers Post Solid Quarterly Sales

	Welcome to the new IRNewsLink Financials Welcome to the new monthly IRNewsLink Financials newsletter. Understanding the financial performance of retailers and the technology and services providers who serve them has never been more important than in today’s economy. With this new monthly edition of IRNewsLink, readers can follow key financial and operations metrics. Included in this report are charts and articles that summarize the monthly activity of retailers’ web sales, the financial performance of key vendors, new equity deals, recent mergers and acquisitions, and Internet Retailer’s new stock index. Web sales continue to increase Internet retailers continue to grow sales both on a quarterly and an annual basis. The combined quarterly sales of 17 web retailers that broke out sales in January and early February grew by 14.1% to $8.25 billion in 2008 from $7.23 billion in the comparable quarter in 2007. The combined annual sales of 14 retailers grew by 24.6% to $23.04 billion in 2008 from $18.49 billion in 2007. Retailers         Company name Period Recent sales (millions) Year ago sales (millions) Change 1-800-Flowers.com Inc. Q2 $230.10 $274.20 -16.1% Amazon.com Inc. Q4 $6,700 $5,670 18.2% Amazon.com Inc. FY $19,170 $14,840 29.2% Coastal Contacts Inc.* Q4 $32.00 $26.70 19.9% Coastal Contacts Inc.* FY $119.00 $102.00 16.7% Cymax Stores Inc. Q4 $16.00 $10.00 60.0% Cymax Stores Inc. FY $50.00 $32.50 53.8% Drugstore.com Inc. Q4 $93.94 $91,30 2.9% Drugstore.com Inc. FY $366.60 $339.30 8.0% Fingerhut Direct Marketing Inc. Q4 $67.80 $65.90 2.9% Fingerhut Direct Marketing Inc. FY $165.00 $144.00 14.6% Indigo Books & Music Inc.* Q3 $24.70 $25.40 -2.8% NBTY Inc. Q1 $23.00 $14.80 55.4% Netflix Inc. Q4 $359.60 $302.40 18.9% Netflix Inc. FY $1,360 $1,200 13.3% One Way Furniture Inc. FY $18.50 $21.10 -12.3% Overstock.com Inc. Q4 $255.90 $294.50 -13.1% Overstock.com Inc. FY $834.40 $765.90 8.9% PetMed Express Inc. Q3 $28.60 $24.40 17.2% Shutterfly Inc. Q4 $107.70 $97.50 10.5% Shutterfly Inc. FY $213.50 $186.70 14.4% Tempur-Pedic International Inc. Q4 $10.10 $19.00 -46.8% Tempur-Pedic International Inc. FY $47.60 $79.70 -40.3% The Talbots Inc. Q4 $28.90 $64.00 -54.8% The Talbots Inc. FY $134.70 $223.40 -39.7% Urban Outfitters Inc. Q4 $79.00 $65.60 20.4% Urban Outfitters Inc. FY $245.20 $185.10 32.5% ValueVision Media Inc. Q4 $45.40 $69.80 -35.0% ValueVision Media Inc. FY $180.80 $250.20 -27.7% VistaPrint Ltd Q2 $138.90 $105.00 32.3% VitaCost.com Inc. Q4 $34.40 $24.50 45.7% VitaCost.com Inc. FY $126.50 $87.80 40.0% *Sales are in U.S. Dollars Quarterly vendor sales grow slightly The combined quarterly sales of 11 companies in January and early February grew by just 0.6% to $21.12 billion in 2008 from $20.99 billion in 2007. The combined annual sales of 10 vendors grew by 11% to $84.40 billion in 2008 from $76.03 billion in 2007. Service & technology providers Company name Period Recent sales (millions) Year ago sales (millions) Change Art Technology Group Inc. Q4 $45.40 $39.30 15.5% Art Technology Group Inc. FY $164.60 $137.10 20.1% CyberSource Corp. Q4 $62.30 $45.40 37.2% CyberSource Corp. FY $229.00 $117.00 95.7% Digital River Inc. Q4 $95.90 $96.90 -1.0% Digital River Inc. FY $394.20 $349.30 12.9% eBay Inc. Q4 $2,040 $2,180 -6.4% eBay Inc. FY $8,540 $7,670 11.3% Google Inc. Q4 $5,700 $4,830 18.0% Google Inc. FY $21,800 $16,600 31.3% GSI Commerce Inc. Q4 $391.40 $335.10 16.8% GSI Commerce Inc. FY $966.90 $750.00 28.9% JDA Software Group Inc. Q4 $106.20 $98.50 7.8% JDA Software Group Inc. FY $390.30 $373.60 4.5% Keynote Systems Inc. Q1 $20.60 $17.70 16.4% LivePerson Inc. Q4 $19.60 $16.77 16.9% LivePerson Inc. FY $74.65 $52.22 43.0% NetSuite Inc. Q4 $41.40 $31.70 30.6% NetSuite Inc. FY $152.50 $108.50 40.6% Omniture Inc. Q4 $83.00 $43.10 92.6% Omniture Inc. FY $296.00 $143.00 107.0% RedPrairie Corp. FY $300.00 $261.20 14.9% RightNow Technologies Inc. Q4 $36.10 $30.70 17.6% RightNow Technologies Inc. FY $140.40 $112.10 25.2% United Parcel Service Inc. Q4 $12,700 $13,390 -5.2% United Parcel Service Inc. FY $51,490 $49,690 3.6% VeriSign Inc. Q4 $247.00 $221.70 11.5% VeriSign Inc. FY $961.73 $847.50 13.5%

	Rising Above - Not Just Surviving - The Economic Storm The Internet Retailer 2009 Conference & Exhibition, America's Fastest Growing Show *, will be held June 15-18, 2009 at the Boston Convention & Exhibition Center. IRCE 2009 is devoted to the strategies and tools that e-retailers can use to thrive in a recession. It draws e-retailers from all channels with the most comprehensive conference agenda and the largest display of e-retailing technology. Hear 179 E-Retail Pros in 94 conference sessions, visit 350 exhibiting companies and network with 5,000 E-Retailers.