Symantec is looking into allegations that a call center employee in India sold credit card numbers of its customers to BBC News reporters in an undercover investigation.
In a letter to New Hampshire Attorney General Kelly Ayotte dated March 24, the security vendor said it was "investigating a potential security incident involving a small number of customers' credit card information".
Symantec said it was sending a notice to an unnamed customer in New Hampshire who may have been affected by the alleged incident, even though the company does not believe a security breach as defined by New Hampshire statue had occurred.
The company said it has no evidence that credit card information of any U.S. residents was actually compromised, nevertheless it was offering its customers one year of identity protection services through Debix and reviewing its "security processes and third-party vendor protocols".
Symantec spokesman Cris Paden told The Wall Street Journal the company was sending letters to more than 200 customers affected by the theft. Paden did not immediately respond to an e-mail seeking comment late on Tuesday.
The BBC News reported on March 19 that undercover reporters posing as fraudsters had gone to Delhi to buy 50 credit card numbers, at US$10 a card, from a man who claimed to have gotten them from a call center. They filmed the interaction.
The man denied any wrongdoing. Symantec told the BBC that it was an isolated incident and that the "single source" of the leak was no longer working there, according to the report.
When the reporters contacted some of the card owners, three of them said they had bought Norton software from Symantec over the phone using their cards and the purchases were found to have been made within hours of each other and the numbers were sent to the BBC shortly thereafter, the report said.
The BBC recently got flack for purchasing a botnet and using it in some tests to show the dangers Web surfers face.
This article was first published as a blog post on CNET News.
Play video
There are currently no comments for this post.