Payment Card Malware Hits Retail Chains Across The US

Hackers have become more adept at creating methods to steal sensitive information that will yield a lucrative payday when sold on the dark web. Personal details fetch a considerable amount of money and are used to steal identities and access bank accounts. According to a cybersecurity research report, if a seller supplies full details about a card and its owner, it could yield between $30 and $45, depending on the region the buyer is from. Purchasers from the European Union will pay more for the information than U.S. buyers, for example.

The promise of quick monetary gain makes payment card malware that much more enticing for attackers. According to the “2016 Data Breach Investigations Report” by Verizon, 89 percent of data breaches had a financial motive. As payment card malware continues to hit retail chains across the U.S., it serves as a critical reminder for organizations to secure their systems and protect their customers.

Customer Data Exposed

Consumers are less likely to go to an organization that has been hit by malware or had personal data exposed. At the end of May 2017, fast-food chain Chipotle reported that nearly all of its 2,000 restaurants had been affected by a security breach. The malware was designed to access payment card data from point-of-sale devices, gathering information like card number, expiration date, verification code and cardholder name, Merced Sun Star reported. While the malware is now removed, new strains are developed quickly and could cause even more damage. The organization is working with cybersecurity firms to improve its protections and prevent similar situations from occurring in the future.

Undetectable Code Breach

Kmart payment systems were also found at the end of May to be infected with malicious software. The malware was undetectable by current anti-virus and application controls, marking it as an example that other organizations should take note of, Krebs on Security reported. Kmart’s parent company Sears Holdings released a statement that no personal information was obtained by the hackers, but that certain credit card numbers may have been compromised. That being said, there’s no clear indication how many locations were impacted or how long the breach persisted.

Like Chipotle, Kmart is working to improve its defenses and respond to new threats. It’s also worth noting that the breach may have mainly impacted those that didn’t use chip-enabled cards. Chips make cards significantly more expensive and difficult to counterfeit, however, not all banks have issued these cards yet.

Retail Impacted By A Long Con

Malware has become so sophisticated that it can lay under the radar for a long period of time before anyone notices that damage has been done. By then, it could be difficult to recover and restore customer trust. More than 220 Brooks Brothers and Brooks Brother Outlet retail locations were impacted in a year-long breach, discovered in March 2017. According to SC Magazine U.K., an unauthorized individual installed malware on payment card systems and may have gotten away with card data necessary to make fraudulent payments. Personal information like Social Security numbers was not affected by this event.

Avoiding Payment Card Malware

Breaches can majorly damage a business’s reputation and cost a significant amount of money to recover information while supporting affected customers. In fact, 66 percent of U.S. consumers stated that they would stop doing business with a hacked organization, according to a 2016 Centrify survey. Additionally, 41 percent hold the corporation fully accountable for the event and believe that companies don’t take enough responsibility when they get hacked. This study demonstrates that consumers no longer tolerate businesses that put their data at risk. Organizations must demonstrate the they have the proper measures in place and can deftly divert attacks.

As more strains of malware emerge and retailers increasingly make the news with their lack of protection, there are a few easy ways to prevent point-of-sale-related intrusions. Organizations should use monitoring tools alongside two-factor authentication to identify unusual behavior and deter unauthorized individuals from installing malicious programs, PCWorld’s Michael Kan suggested. Encryption will also be essential to keeping sensitive data encoded and unusable if stolen. Businesses should test their systems to look for vulnerabilities and make adjustments to improve their security posture.

Protection of payment card data is essential to every business and can have serious financial and reputational consequences if it’s not upheld. These recent incidents are clear indications that attackers are stepping up their game to make malware less detectable and more effective than ever before. Organizations can use reboot to restore solutions to maintain configurations across their devices and ensure that any unauthorized downloaded programs are removed. With regular automated maintenance schedule, businesses can deter payment card malware and better protect their customers.