Authorize.net Says It Has DDOS Attack Under Control

Authorize.net, which has been the victim of a series of denial-of-service attacks since Sept. 15, says today it has implemented unspecified “industry-leading solutions” that are thwarting the assaults on its data centers, which process card transactions for more than 100,000 merchants. It also says its engineers from the start of the attacks have been able to “minimize” the impact on its merchants. “There's been a brief and sporadic impact on merchants,” says David S. Schwartz, director of marketing for the American Fork, Utah-based processor, which serves as a transaction gateway primarily for Internet merchants. “We feel confident that with the solutions we have in place, DDOS attacks of this scope and pattern will no longer affect our merchants.” Schwartz refuses to give specifics about the processor's remedies or about the pattern of the attacks, fearful that details would help those who launched the attacks. He does say the company is pretty sure the attacks are originating outside the U.S. The party behind the attacks, Schwartz said, sent the company a letter demanding payment of a “substantial” sum of money to refrain from launching the assault. When Authorize.net refused to pay, the attacks began. Authorize.net is pursuing the matter with law enforcement. This sort of attack, called “DDOS” in computer parlance, seeks to shut down a data center by flooding it with huge volumes of electronic commands, usually generated from thousands of computers hijacked by hackers. The criminals behind the attacks seek to extort money from the victim organization in return for stopping, or refraining from launching, the DDOS assault. Such attacks have grown increasingly common in recent months. This is not the first time Authorize.net has been victimized, though Schwartz says previous attacks were “nothing close to the scale and maliciousness of this attack.” Though downtime and lost sales for client merchants have been minimized during this episode, he says, estimates of both are “internal” matters that the company will not disclose.