![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
thewayneThe info on Albertsons is just emerging and it involves all of their properties, so this looks like a breech in their datacenter like Target. His discussion of carding is quite interesting as it hits on two points that I thought were pretty amazing. One is that the rate of attacks seems to be going up and it probably because the USA hasn't instituted Chip & Pin, which most of the first world has done. Thus, America is a vulnerable market, and since Mastercard & Visa have stated an October 2015 deadline for merchants to implement C&P, the criminals have a narrowing window of opportunity to exploit and try to get rich easily.
The fact that the USA is the only country in the G20 to not have implemented C&P I thought was quite interesting.
But his second point blew me away: he thinks the market for stolen card dumps is saturated. Krebs estimates that only 2-4% of the cards stolen in the Target breech were actually used for fraud, based on numbers that were reported to him when he called some banks that were victimized. The process for taking the card data, coding it on to a new card, then buying merchandise, selling it, and transferring the money takes a lot of work and with the volume of cards stolen in the breeches, the criminals don't have enough infrastructure to convert the stolen info to money in their pocket.
Which isn't to say that they're going to stop stealing credit card info, just that there is a difference between the number of cards stolen and the number used for fraud.
http://krebsonsecurity.com/2014/08/why-so-many-card-breaches-a-qa/
The fact that the USA is the only country in the G20 to not have implemented C&P I thought was quite interesting.
But his second point blew me away: he thinks the market for stolen card dumps is saturated. Krebs estimates that only 2-4% of the cards stolen in the Target breech were actually used for fraud, based on numbers that were reported to him when he called some banks that were victimized. The process for taking the card data, coding it on to a new card, then buying merchandise, selling it, and transferring the money takes a lot of work and with the volume of cards stolen in the breeches, the criminals don't have enough infrastructure to convert the stolen info to money in their pocket.
Which isn't to say that they're going to stop stealing credit card info, just that there is a difference between the number of cards stolen and the number used for fraud.
http://krebsonsecurity.com/2014/08/why-so-many-card-breaches-a-qa/
