Archived Content

The following content is from an older version of this website, and may not display correctly.

Canadian Bitcoins, an Ottawa-based exchange service for virtual currency, saw CA$100,000 worth of bitcoins disappear from its servers in a Rogers colocation data center after a staffer gave a person who identified themselves as the exchange's owner in an online customer-service chat access to the equipment without verifying their identity.

 

“The fraudster used the 'sales chat tool' on their website to initiate a two hour chat session with Rogers staff, during which time, Rogers staff facilitated a breach of our equipment,” Canadian Bitcoins representatives wrote in a statement. “It is important to note that this breach occurred without any authentication being performed by the Rogers data center staff whatsoever.”

 

Newspaper Ottawa Citizen has obtained a copy of the chat session, which took place in early October 2013, and confirmed that the staffer had not asked to verify the caller's identity during the two-hour-long session.

 

The data center belonged to Granite Networks, a company Rogers bought in 2013. It announced the acquisition at the end of September of that year, or few days before the incident occurred.

 

The user identified himself as Canadian Bitcoins owner James Grant and asked the staffer to gain access to a server and reboot it in recovery mode. This allowed him to bypass security.

 

The chat session resulted in about 150 bitcoins disappearing from the server, the Citizen reported. Canadian Bitcoins said the stolen bitcoins were its own and no customer currency had been affected.

 

The company does not store bitcoins for customers, as its service consists of facilitating purchases and sales of bitcoins. It said the attacker had not gained access to any customer data.

 

Rogers told the Citizen that the situation was unique to the customer and did not apply to its other data center tenants.

 

“Its security protocol is operationally certified and in accordance with industry best practices,” the data center operator said in a statement. “We have reviewed our security processes and continue to work with our customers to make sure they take advantage of all of our security features.”

 

Rogers has offered full compensation for the losses to Canadian Bitcoins. The exchange operator has moved its servers to a different provider's data center.