It feels like new reports are coming out almost every day of major retail chains whose computers were hacked, leaving consumers exposed to identity theft and credit card fraud. But new information from the Secret Service may have found the connection between many of these recent data breaches.
Last month, the Secret Service released a report on its findings that may show a high number of companies were all breached by the same malware, known as Backoff. This program infiltrates the companies’ computers and point-of-sale credit card machines to gather information from the magnetic strips on the backs of credit cards. This method, known as RAM scraping, may have been put into effect from software that infected as many as seven different POS device manufacturers and distributors’ systems.
One of the most widely talked about recent breaches involved the retail chain Target, whose POS systems were hacked last year. That breach led to nearly 110 million consumers’ credit card information being accessed by criminals and sold on the internet to other thieves. The effects of that breach are still causing harm; Target has already paid a reported $148 million to clean up the damage, and credit card companies are still monitoring their members’ accounts. There have also been numerous pending lawsuits filed against Target for the breach given the news that the company was warned about vulnerabilities in their system by their own IT experts.
The Secret Service has yet to name the retailers that they believe were impacted by this malware infection, and hasn’t named the POS machine developers either. But they do seem to believe that the same malware has caused multiple major-name data breaches and that it began its malicious work in October of last year, right as the holiday shopping season began to kick off.
Interestingly, information from one of the leading cybersecurity experts in the country, Brian Krebs, links the spread of malware in data breach victims to employees who open and respond to phishing emails, those messages that contain a link that entice users to click it. By clicking the link, the employee accidentally downloads the malware and infects the entire system. In Target’s case, an employee at one of its third-party contractors who handles heating and cooling in the stores seems to have infected Target’s computers. A similar method of infecting computers can easily have happened at any of the recently breached companies.
While it’s up to the retailers to sort out how to investigate and clean up from a data breach, there are steps that consumers can take to protect themselves. The first lesson to be learned is almost too obvious: never, ever click on a link in an email unless you trust the source and can verify that it is not harmful. Also, keep your malware and antivirus subscriptions up to date, and always remember to download those pesky updates that your computer reminds you about from time to time. Those updates are helping your computer recognize and block the newest viruses or malware.
If you do suspect that you were a victim of a corporate data breach, remember to take the information seriously. When corporations offer credit monitoring services as part of their clean-up efforts, be sure to activate those subscriptions as soon as you’re informed. you do suspect that you were a victim of a corporate data breach, remember to take the information seriously. When corporationOf course, there’s no reason to wait for a company to discover it’s been hacked. Stay on top of your credit card statements, bank statements, and credit reports and watch for any suspicious activity so you can take action before things get out of hand, and report any strange purchases to your bank or card provider immediately.
If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center's Anyone3 fundraising campaign. For more information or to donate please visit http://www.idtheftcenter.org/anyone-3.