Retail Breaches: Congress Wants Answers Neiman Marcus Offers More Information; Target to Testify Congress is demanding answers about the recent retail malware attacks against Target Corp. and Neiman Marcus. And its efforts are yielding results. On Jan. 22, Neiman Marcus responded to questions posed in a letter from Sen. Richard Blumenthal, D-Conn., about its breach. In is reply to the senator, the retailer reveals some significant new details. For example, it says suspicious activity was first noted on Dec. 13, 2013, and that the sophisticated malware used in the attack evaded intrusion detection and clandestinely penetrated payments systems to obtain credit card information. The retailer also says that a related malware attack, separate from the one that ultimately compromised its network, appears to have been clandestinely inserted earlier in 2013. Meanwhile, a Target official will testify before a House panel in early February at a hearing devoted to data breaches and their impact on consumers. Also, the American Bankers Association and the National Retail Federation have each written to Congress, with the organizations doing a bit of finger pointing about the roles and obligations the banking and retail sectors have for ensuring security across the payments chain. Neiman Marcus Outlines Attack On Jan. 13, Blumenthal asked Neiman Marcus, whose breach is now believed to have exposed more than 1 million debit and credit cards, why it waited several weeks to report its breach. He also asked that Neiman Marcus provide free credit monitoring and identity theft insurance to consumers In its response, and a notice to the public, Neiman Marcus said that it would provide two years of free credit monitoring as well as ID theft insurance to all consumers who had shopped in its stores between Jan. 1, 2013, and Jan. 1, 2014 (see When Did Neiman Marcus Breach Start?). Neiman Marcus, in its letter to the senator, says its deeply disturbed by the apparently widespread and sophisticated efforts to break into the computer systems of retailers in the United States in an attempt to steal payment card information. The company says it was not aware of any of this hidden malware until it was discovered this month by our investigative experts. Most notably, Neiman Marcus says it was first notified Dec. 13 by its merchant processor that fraudulent transactions had been traced back to a small number of its retail locations. An internal investigation was then initiated to determine if systems had been compromised. Later, alerts dating from Dec. 17 through Dec. 20 from Visa and MasterCard suggested that more than 200 cards with fraudulent transactions had been linked to Neiman Marcus. Some 122 compromised MasterCard cards had been used in one Neiman Marcus location, the retailer states. On Dec. 23, Neiman Marcus contacted federal authorities, and on Dec. 27, the retailer agreed to work with federal investigators, according to its letter to the senator. The scraping malware was complex and its output encrypted, Neiman Marcus states. Over the next several days, the investigative firms worked to decrypt the output file by first reversing the malware to determine the encryption algorithm and then creating a script that employed the attackers algorithm to the encrypted data in order to decrypt it. It was only after this decryption process was concluded that we were able to determine that payment card information had been captured.
Posted on: Mon, 27 Jan 2014 14:58:19 +0000
Trending Topics
Recently Viewed Topics
© 2015