US Retail Chain Reports Data Theft; How Safe Are You? | TechTree.com

US Retail Chain Reports Data Theft; How Safe Are You?

With India’s point of sales systems growing steadily, it could easily be the next target on some cybercriminal’s mind

 

Every news break about a security breach compromising the personal data of millions of people stays in public memory precisely till the moment the next one gets reported. Which is as it should be as we dwell on thought that “it wasn’t us” and move on with life. However, this time round there is something to fear.

Earlier this week, hackers put up the credit and debit card details of more than 30 million Americans (yes, it’s still happening elsewhere) and over a million foreigners (could you be one of them though?) on internet’s largest card fraud forum called Joker’s Stash. Where did the data come from? A convenience store chain on the US East Cost called Wawa.

Threat intelligence firm Gemini Advisory reported the theft from Wawa and the sale of data in a blog post on their website. The company says that since the breach may have affected all 860 stores and affected 30 million records, the latest point-of-sales (POS) breach may be the biggest of all time.

Wawa had disclosed the major security breach in December stating that malware collected card details from all customers who used credit or debit cards to buy goods at their stores of which a majority doubled up as fuel stations. It said the malware operated for months before it was detected on December 12 and removed.

Similar breaches involving Home Depot in 2015 and Target a year earlier come to mind though on this occasion, Gemini Advisory believes that in the latest hacking even PIN numbers and CVV numbers got compromised alongside the usual card information. This was confirmed by ZDNet in a post after it obtained samples of the hacked data.

Which brings us to the moot question on why these POS breaches happen time and again and what, if anything could be done to prevent it and safeguard customer data? Given that India is steadily growing its digital payments, there needs to be a focus on prevention as it is only a matter of time before cybercriminals turn their attention this way.

In a blog post, online security and anti-malware maker Norton says the SMEs are easy targets for cybercriminals because they are lax with POS systems “The POS systems that these companies use to ring you up are basically computers that often run on Windows, and are as susceptible to the same threats that a regular Windows-based computer is vulnerable to.”

How Do They Do It?

The credit card data is first stored on the machine, unencrypted for processing purposes. When malware finds its way onto the machine, it goes after the unencrypted stored payment information. The malware collects the data and then sends the information to a remote server, says the blog post authored by Nadia Kovacs.

However, this doesn’t mean that larger enterprises are safer, as is evident from the latest hack of Wawa records. The blog says that attackers need to work harder to breach bigger companies that operate POS systems off a centralized server. Sending phishing mails with malware to staff is the most common approach to infect these systems.

How to Stay Protected?

While enterprises need to shift focus on security as a must-have and not a good-to-have, for individuals the only means to stay safe is to take ownership of your data, because if you don’t, nobody else will. Here are a few things that you can do on a regular basis:

  • A simple and effective way is to rely on regular monitoring of bank accounts, credit reports and other financial accounts. Sign up for activity alerts on your accounts. Immediately report any activity that appears out of sync with your behaviour.
  • In case you fear that your data has been breached, get as much information as possible. While doing so remember to alert your credit or debit card provider and immediately request a change in PIN or CVV number, preferably both.
  • Keep an eye open for company announcements, especially those with whom you transact regular business. For, a security breach can come up in the most unlikely places, including government records. Sign up for their newsletters and alerts and ensure they don’t reach the spam box on your email.
  • And finally, in case you happen to be a client of one such company don’t sit back and think that it couldn’t have been your data. There is a one in a million chance that it is yours and ignoring the warning could prove disastrous now or even many months later.

Remember that there are anti-fraud laws and cyber protection laws everywhere but they can’t protect your data from cybercriminals who circumvent these laws. So, staying alert and being responsible for your data could be the only way to stay safe in an age where digital payments and receipts are the norm and no more the exception.


TAGS: Cybercrime, Data Breach, Wawa, Gemini Advisory, CreditCard, Credit Card Fraud, POS Systems

 
News Corner
IMP IMP IMP
##