I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about fraudulent credit card charges on our site and others. This leads me to believe that someone was able to get a list of our credit card numbers. What doesn't make sense is that we don't store that information and we use Authorize.net for the transaction. If someone was able to get the CC#s, what should I do next? Inform ALL of our customers that someone broken into our system and stole their information? I have a feeling that will be bad for business.
It could shut your business down.
If you do not store the card details, then identify how there could be a leak - quickly.
[I believe they are allowed to fine you upto $100,000 per incident if you fail to notify within 24 hours of discovery.]
If you find a leak, then do not notify customers, notify the credit card companies, they require you to do this and failure to do so can land you in very hot water in deed. Expect to be required to be audited at a minimum, you could be heavily fined as a company.
If you are certain that the card numbers have been leaked, no matter who is at fault, it would be in your best interest to inform everyone affected (The appropriate law officials and credit card companies too). Giving them advance warning now will look better than them getting ripped off by some thief and then finding out how their card number got stolen.
Well first and foremost if they captured the CC#'s you are in more trouble than you could ever imagine as that is against the law, at least in the US (apologies if you are not in the US). Authorize.net isn't really on the hook here as it was the poor coding of your web application, that being said what does the contract with Authorize.net state? Ideally there is no liability on your side and they take full responsibility. Worst case is you have to bite the bullet and risk law suits.