[Krebs on Security] Breach Rumor Mill Puts Retailers on Defensive

Krebs on Security has posted a new item.

In response to rumors in the financial industry that Sears may be the latest
retailer hit by hackers, the company said today it has no indications that it
has been breached. Although the Sears investigation is ongoing, experts say
there is a good chance the identification of Sears as a victim is a false alarm
caused by a common weaknesses in banks' anti-fraud systems that becomes apparent
mainly in the wake of massive breaches like the one at Target late last year.

Earlier this week, rumors began flying that Sears was breached by the same sort
of attack that hit Target. In December, Target disclosed that malware installed
on its store cash registers compromised credit and debit card data on 40 some
million transactions. This publication reached out on Wednesday to Sears to
check the validity of those rumors, and earlier today Bloomberg moved a brief
story saying that the U.S. Secret Service was said to be investigating a
possible data breach at Sears.

But in a short statement issued today, Sears said the company has found no
information indicating a breach at the company.

"There have been rumors and reports throughout the retail industry of security
incidents at various retailers, and we are actively reviewing our systems to
determine if we have been a victim of a breach," Sears said in a written
statement. "We have found no information based on our review of our systems to
date indicating a breach."

The Secret Service declined to comment.

Media stories about undisclosed breaches in the retail sector have fueled
rampant speculation about the identities of other victim companies. Earlier this
week, The Wall Street Journal ran a piece quoting Verizon Business's Bryan
Sartin saying that the company -- which investigates data breaches -- was
responding to two different currently undisclosed breaches at major retailers.

Interestingly, Sartin gave an interview last week to this publication
specifically to discuss a potential blind spot in the approach used by most
banks to identify companies that may have had a payment card breach -- a
weakness that he said almost exclusively manifests itself directly after large
breaches like the Target break-in.

http://krebsonsecurity.com/2014/02/breach-rumor-mill-puts-retailers-on-defensive/


Please use the link above to continue reading this posting.

You received this e-mail because you asked to be notified when new updates are
posted.

Best regards,

BrianKrebs
http://krebsonsecurity.com

P.S. You may manage your subscription here:
http://krebsonsecurity.com/#subscribe2