Michael's/Aaron Brothers Art Mart join the ranks of hacked retailers

[thewayne]

Details are very preliminary and sketchy, it was suspected that both crafting store retailers had been hacked then it was found out that Michael's bought out Aaron Bros, so they're really one in the same. I expect the date range of the compromise will probably come out next week and we'll begin getting a feeling for what the scope of the hack is. Cards are appearing on underworld web sites and they all traced back to Michael's or Aaron Brothers as the common point.

http://krebsonsecurity.com/2014/01/sources-card-breach-at-michaels-stores/


In other retailer hacking news, Neiman Marcus revealed that they were compromised from the middle of July to the end of October 2013.

I think it's time for me to create a 'Retailer Compromise' tag.

Comments

[silveradept]

Good Godfrey, next thing will be the grocery stores and the warehouse clubs and we'll all be long for fraud alerts.

[thewayne.livejournal.com]

You don't hear about major online-only presences having their payment system hacked, at least yet. I also haven't heard about movie theater chains being taken. There have been some restaurants, I recall that Dave & Busters was part of the TJ Maxx-era hack.

And they're saying that Chip & Pin technology, which is in use all over Europe, will take at least five years to implement because all point of sale terminals have to be replaced after all of the background servers and software are updated, then you have to replace all the cards and get people used to them.

Basically there is no end in site, and you're more likely to be hacked at a big store than a small store or chain. So I think the best way to protect yourself is to hit an ATM and withdraw $100, or whatever, before going grocery shopping. I've read lots of stories of skimmers being installed in gas pumps and point of sale terminals, but not many of ATMs getting physically compromised.

The scary thing? I recently read something like 60-70% of ATMs are still running Windows XP.

[silveradept]

That is very scary. I don't think Windows should be used as an operating system for anything secure, especially not banking.

[thewayne.livejournal.com]

And yet Windows is the preferred OS in all manner of military, defense, government, etc. applications.

It's all marketing. Control the desktop and dictate the back-end.