Target Settles Security Breach

Target is reportedly close to paying out $10m to settle a class-action case that was filed after it was hacked and stripped of tens of millions of peoples’ details.

Target was smacked by hackers in 2013 in a massive cyber-thwack on its stores and servers that put some 70 million people’s personal information in harm’s way.

The hack has had massive repercussions. People are losing faith in industry and its ability to store their personal data, and the Target incident is a very good example of why people are right to worry.

As well as tarnishing Target’s reputation, the attack also led to a $162m gap in its financial spreadsheets.

The firm apologized to its punters when it revealed the hack, and chairman, CEO and president Gregg Steinhafel said he was sorry that they have had to “endure” such a thing

Now, according to reports, Target is willing to fork out another $10m to put things right, offering the money as a proposed settlement in one of several class-action lawsuits the company is facing. If accepted, the settlement could see affected parties awarded some $10,000 for their troubles.

We have asked Target to either confirm or comment on this, and are waiting for a response. For now we have an official statement at Reuters to turn to. There we see Target spokeswoman Molly Snyder confirming that something is happening but not mentioning the 10 and six zeroes.

“We are pleased to see the process moving forward and look forward to its resolution,” she said.

Not available to comment, not that we asked, will be the firm’s CIO at the time of the hack. Thirty-year Target veteran Beth Jacob left her role in the aftermath of the attack, and a replacement was immediately sought.

“To ensure that Target is well positioned following the data breach we suffered last year, we are undertaking an overhaul of our information security and compliance structure and practices at Target,” said Steinhafel then.

“As a first step in this effort, Target will be conducting an external search for an interim CIO who can help guide Target through this transformation.”

“Transformational change” pro Bob DeRodes took on the role in May last year and immediately began saying the right things.

“I look forward to helping shape information technology and data security at Target in the days and months ahead,” he said.

“It is clear to me that Target is an organization that is committed to doing whatever it takes to do right by their guests.”

We would ask Steinhafel for his verdict on DeRodes so far and the $10m settlement, but would you believe it, he’s not at Target anymore either having left in the summer last year with a reported $61m golden parachute.

Source

Yet Another Retailer System Hacked

Women’s clothing retailer Bebe Stores has become the latest in a growing list of national retailers to be hit by an attack on its credit card payment system.

The company said Friday that the cardholder name, account number, expiration date, and verification code could have been stolen by hackers who apparently had access to the company’s payment processing system between Nov. 8 and 26.

The incident came to light in late November when Bebe said it noticed suspicious activity on computers that operate the payment processing system. Stores affected were the roughly 200 it operates in the U.S., Puerto Rico and the U.S. Virgin Islands.

“If you used a payment card at a U.S., Puerto Rico or U.S. Virgin Islands store during this time frame, you should review your account statements for any unauthorized activity,” it said in a message to customers.

The last couple of years have been bad ones for the safety of credit card data at major U.S. retailers. Millions of credit and debit card numbers have been compromised in breaches at retailers, including Target, Home Depot, PF Chang’s restaurants, Super Valu grocery stores, Neiman Marcus, UPS Store and others.

In many cases, the attacks were targeted at payment processing terminals and used sophisticated malware that stole card details as consumers swiped their cards. Many of the thefts were only discovered after the card numbers appeared for sale on Internet hacking forums.

Such was the case with Bebe Stores. First news of the hack came earlier this week through the closely followed Krebs on Security blog.

Source

MasterCard Testing New Fingerprint Reader

MasterCard is trying out a contactless payment card with a built-in fingerprint reader that can authorize high-value payments without requiring the user to enter a PIN.

The credit-card company showed a prototype of the card in London on Friday along with Zwipe, the Norwegian company that developed the fingerprint recognition technology.

The contactless payment card has an integrated fingerprint sensor and a secure data store for the cardholder’s biometric data, which is held only on the card and not in an external database, the companies said.

The card also has an EMV chip, used in European payment cards instead of a magnetic stripe to increase payment security, and a MasterCard application to allow contactless payments.

The prototype shown Friday is thicker than regular payment cards to accommodate a battery. Zwipe said it plans to eliminate the battery by harvesting energy from contactless payment terminals and is working on a new model for release in 2015 that will be as thin as standard cards.

Thanks to its fingerprint authentication, the Zwipe card has no limit on contactless payments, said a company spokesman. Other contactless cards can only be used for payments of around €20 or €25, and some must be placed in a reader and a PIN entered once the transaction reaches a certain threshold.

Norwegian bank Sparebanken DIN has already tested the Zwipe card, and plans to offer biometric authentication and contactless communication for all its cards, the bank has said.

MasterCard wants cardholders to be able to identify themselves without having to use passwords or PINs. Biometric authentication can help with that, but achieving simplicity of use in a secure way is a challenge, it said.

Source

Hackers Infiltrate Jimmy Johns

Sandwich restaurant chain Jimmy John’s said there was a potential data breach involving customers’ credit and debit card information at 216 of its stores and franchised locations on July 30.

An intruder stole log-in credentials from the company’s vendor and used the credentials to remotely access the point-of-sale systems at some corporate and franchised locations between June 16 and Sept. 5, the company said.

The chain is the latest victim in a series of security breaches among retailers such as Target Corp, Michaels Stores Inc and Neiman Marcus.

Home Depot Inc  said last week some 56 million payment cards were likely compromised in a cyberattack at its stores, suggesting the hacking attack at the home improvement chain was larger than the breach at Target Corp.

More than 12 of the affected Jimmy John’s stores are in Chicago area, according to a list disclosed by the company.

The breach has been contained and customers can use their cards at its stores, the privately held company said.

Jimmy John’s said it has hired forensic experts to assist with its investigation.

“Cards impacted by this event appear to be those swiped at the stores, and did not include those cards entered manually or online,” Jimmy John’s said.

The Champaign, Illinois-based company said stolen information may include the card number and in some cases the cardholder’s name, verification code, and/or the card’s expiration date.

Source

Bitcoin Use Growing

Bitcoin is gaing greater acceptance at U.S. online merchants including Overstock.com and Expedia, as customers use a digital currency that just a few years ago was virtually unknown but is now showing some staying power.

Though sales paid for in bitcoin so far at vendors interviewed for this article have been a fraction of one percent, they expect that as acceptance grows, the online currency will one day be as ubiquitous as the internet.

“Bitcoin isn’t going anywhere; it’s here to stay,” said Michael Gulmann, vice president of global products at Expedia Inc. in Seattle, the largest online travel agent. “We want to be there from the beginning.” Expedia started accepting bitcoin payments for hotel bookings on July 11.

Until recently a niche alternative currency touted by a fervent group of followers, bitcoin has evolved into a software-based payment online system. Bitcoins are stored in a wallet with a unique identification number and companies like Coinbase and Blockchain can hold the currency for the user.

When buying an item from a merchant’s website, a customer simply clicks on the bitcoin option and a pop-in window appears where he can type in his wallet ID number.

Still, broad-based adoption of bitcoin is at least five years away because most consumers still prefer to use credit cards, analysts said.

“Bitcoin is a new way of making payments, but it’s not solving a problem that’s broken,” said George Peabody, payments consultant at Glenbrook Partners in Menlo Park, California. “Retail payments aren’t broken.”

There are also worries about bitcoin’s volatility: its price in U.S. dollars changes every day.

That risk is borne by the consumer and the bitcoin payment processor, such as Coinbase or Bitpay, not the retailer. The vendor doesn’t hold the bitcoin and is paid in U.S. dollars. As soon as a customer pays in bitcoin, the digital currency goes to the payment processor and the processor immediately pays the merchant, for a fee of less than 1 percent.

“We don’t have to deal with the actual holding of the bitcoin: it’s the payment processor that takes the currency risk for us,” said Bernie Han, chief operating officer at Dish Network Corp, in Englewood, Colorado. “That’s what makes it appealing for us and I guess for other merchants as well.”

Source

UPS Breached

Credit and debit card information belonging to customers made purchases at 51 UPS Store Inc. locations in 24 states this year may have been illegally accessed as the result of an intrusion into the company’s networks.

In a statement on Wednesday, UPS said it was recently notified by law enforcement officials about a “broad-based malware intrusion” of its systems.

A subsequent investigation by an IT security firm showed that attackers had installed previously unknown malware on systems in more than four-dozen stores to gain access to cardholder data. The affected stores represent about 1% of the 4,470 UPS Store locations around the country.

The intrusion may have exposed data on transactions conducted at the stores between Jan. 20 and Aug. 11, 2014. “For most locations, the period of exposure to this malware began after March 26, 2014,” UPS said in a statement.

In addition to payment card information, the hackers also appear to have gained access to customer names, as well as postal and email addresses.

Each of the affected locations is individually owned and runs private networks that are not connected to other stores, UPS added. The company provided alist of affected locations.

The breach is the third significant one to be disclosed in the past week. Last Thursday, grocery store chain Supervalu announced it had suffered a malicious intrusion that exposed account data belonging to customers who had shopped at about 180 of the company’s stores in about a dozen states. The breach also affected customers from several other major grocery store chains for which Supervalu provides IT services.

Source

Visa Digital Wallet Coming

Visa Inc, the world’s largest credit and debit card processing network, is designing a digital wallet that people can use to pay for things on the Internet or with their phones instead of with traditional plastic cards.

The network said on Wednesday it is collaborating with several large U.S. and international banks to create the wallet. Its partners include US Bancorp, PNC Financial Services, Regions Financial, BB&T Corp, Toronto Dominion’s TD Bank and the U.S. arm of Barclays PLC.

The “digital wallet” will store the banks’ customers’ credit and debit card account information, both for Visa cards as well as other cards. People can use the wallet to pay for things online or in stores, Visa said.

The network will also have to convince merchants to put a new “one-click” button on their websites, so that potential customers can use their Visa digital wallets to buy things by clicking the button instead of by manually entering all of their account information every time they want to make an online purchase.

Banks, mobile phone operators and networks like Visa are all trying to gain territory in the small, but high-potential market for U.S. mobile payments. Last week Isis, a separate mobile payments venture run by three of the top four U.S. carriers, said it had modified its initial goals and was now open to working with Visa and MasterCard as it introduces its own mobile wallet.

Jim McCarthy, Visa’s head of global products, told Reuters in an interview on Wednesday that mobile payments in the United States “will more easily take off” from people using their smartphones’ browsers to buy things online.

Read More…

Amex Debuts Mobile Payment System

American Express has just debuted a digital payment and commerce service that makes it possible to use Android-based devices and Apple iPhones for person-to-person online payments. Visa announced a similar personal payment product in the U.S. on March 16.

Analysts say the moves by Visa and American Express are clearly aimed at challenging PayPal in the personal payments business.

The new Amex service, named Serve, allows consumers and small businesses to make purchases and person-to-person payments on iOS- and Android-based devices. Serve accounts are also accessible on personal computers through Facebook and at Serve.com.

Serve also allows users to create and manage sub-accounts for friends and family members.

Read more….

« Previous Page