Exclusive: FBI warns retailers to expect more credit card breaches
By Jim Finkle and Mark Hosenball
WASHINGTON (Reuters) - The FBI has warned U.S. retailers to prepare for more cyber attacks after discovering about 20 hacking cases in the past year that involved the same kind of malicious software used against Target Corp in the holiday shopping season.
The U.S. Federal Bureau of Investigation distributed a confidential, three-page report to retail companies last week describing the risks posed by "memory-parsing" malware that infects point-of-sale (POS) systems, which include cash registers and credit-card swiping machines found in store checkout aisles.
"We believe POS malware crime will continue to grow over the near term, despite law enforcement and security firms' actions to mitigate it," said the FBI report, seen by Reuters.
"The accessibility of the malware on underground forums, the affordability of the software and the huge potential profits to be made from retail POS systems in the United States make this type of financially motivated cyber crime attractive to a wide range of actors," the FBI said.
The report was dated January 17 and entitled "Recent Cyber Intrusion Events Directed Toward Retail Firms." A spokeswoman for the FBI confirmed the agency had issued the report as part of efforts to share information about threats with the private sector.
Retail, credit card and bank industry executives have become increasingly concerned about the security of payment card networks after Target, the No. 3 U.S. retailer, last month disclosed one of the biggest retail cyber attacks in history.
The attack ran undetected for 19 days during the busy holiday shopping season and resulted in the theft of about 40 million credit and debit card records. The personal information of 70 million customers was also compromised.
Luxury retail chain Neiman Marcus has said it too was the victim of a cyber attack, and sources have told Reuters that other retail chains have also been breached. Neiman Marcus said about 1.1 million customer cards were exposed by a data breach from July 16 to October 30 last year. Continued...