Potential data breach revealed by Supervalu

[dlevere]

I'm going to just pay cash for everything from now on. I'm getting sick of all of these data breaches. dlevere.

EDEN PRAIRIE, Minn. (AP) — The grocery chain Supervalu said Friday that it may have suffered a data breach at stores in as many as five states.

Hackers accessed a network that processes store transactions. Account numbers, expiration dates, cardholders' names and other information may have been stolen, the company said.

Grocery stores — as well as some stand-alone liquor shops — in Minnesota, Virginia, Illinois, Maryland and Missouri may have been affected between June 22 and July 17.

The cards from which data may have been stolen were used at 180 Supervalu stores and liquor stores run under the Cub Foods, Farm Fresh, Hornbacher's, Shop 'n Save and Shoppers Food & Pharmacy names. Data may also have been stolen from 29 franchised Cub Foods stores and liquor stores.

There was also a related criminal intrusion at some stores owned and run by Albertson's LLC and New Albertson's Inc., the company said. Supervalu provides information technology services to the Albertson's and New Albertson's stores.

Supervalu said that it currently believes the data breach did not impact its owned or licensed Save-A-Lot stores or any of the independent grocery stores supplied by the company through its independent business network other than the franchised Cub Foods stores previously mentioned.

Once it learned of the breach, the company said that it took immediate steps to secure that portion of its network.

An investigation into the incident is ongoing.

The company hasn't determined if any cardholder data was actually stolen and said Friday that there's no evidence of the data being misused. The release of information about the breach was released out of "an abundance of caution," the company said. It is believed that the intrusion has been contained, the company said, and it remains confident shoppers can safely use their credit and debit cards at its stores.

The intrusion at Supervalu is just the latest in a string of data breaches at major retailers.

Earlier this month, Target said that expenses tied to a breach leading up to last year's holiday shopping season could reach as high as $148 million. The incident led to a major shakeup and CEO Gregg Steinhafel resigned.

Restaurant operator P.F. Chang's confirmed in June that data from credit and debit cards used at its restaurants was stolen.

There have been smaller breaches at Neiman Marcus and Michaels Stores Inc., and even at Goodwill.

There are currently efforts underway to change the technology used in credit and debit cards to make consumer information more secure.

Supervalu Inc., based in Eden Prairie, is offering customers whose cards may have been affected a year of complimentary consumer identity protection services via AllClear ID. The company has created a call center to help answer customer questions about the data breach and the identity protection services being offered. The call center can be reached at (855) 731-6018. Customers may also visit Supervalu's website under the Consumer Security Advisory section to get more information about the data breach and the identity protection services.

Source

[bungholio]

I already pay cash for every little thing. No debit or credit cards for anything. The only thing not cash is my rent/electricity/internet bills. Every little thing gets a data breach. The only hack with cash is counterfeit cash. If you didn't make the bills and knowingly use them, you are not at fault, and it's rare you encounter them.

[dlevere]

Why So Many Card Breaches? A Q&A

By Brian Krebs

The news wires today are buzzing with stories about another potentially major credit/debit card breach at yet another retail chain: This time, the apparent victim is AB Acquisition, which operates Albertsons stores under a number of brands, including ACME Markets, Jewel-Osco, Shaw’s and Star Markets. Today’s post includes no special insight into this particular retail breach, but rather seeks to offer answers to some common questions regarding why we keep hearing about them.

Why do we keep hearing about breaches involving bricks-and-mortar stores?

Credit and debit cards stolen from brick-and-mortar stores (called “dumps”) usually sell for at least ten times the price of cards stolen from online merchants (referred to in the underground as “CVVs” or just “credit cards”). As a result, dumps are highly prized by today’s cyber crooks, and there are dozens of underground “card shops” online that will happily buy the cards from hackers and resell them on the open market. For a closer look at how these shops work (and how, for example, the people responsible for these retail break-ins very often also are actually running the card shops themselves) see Peek Inside a Carding Shop.

Okay, I’ll bite: Why are dumps so much more expensive and valuable to attackers?

A big part of the price difference has to do with the number of steps it takes for the people buying these stolen cards (a.k.a. “carders”) to “cash out” or gain value from the stolen cards. For example, which of these processes is likely to be more successful, hassle-free and lucrative for the bad guy?

1. Armed with a stack of dumps, a carder walks into a big box store and walk out with high-priced electronics or gift cards that you can easily turn into cash.

2. Armed with a list of CVVs, a carder searches online for stores that will ship to an address that is different from the one on the card. Assuming the transaction is approved, he has the goods shipped to a guy he knows at another address who will take a cut of the action. That is, *if* the fraudulently purchased goods don’t get stopped or intercepted along the way by the merchant or shipping company when someone complains about a fraudulent transaction.

If you guessed #1, you’re already thinking like a carder!

Snap! But it seems like these breaches are becoming more common. Is that true?

It’s always hard to say whether something is becoming more common, or if we’re just becoming more aware of the thing in question. I think it’s safe to say that more people are looking for patterns that reveal these retail breaches (including yours truly, but somehow this one caught me– and just about everyone I’ve asked — unawares).

Certainly, banks — which shoulder much of the immediate cost from such breaches — are out for blood and seem more willing than ever to dig deep into their own fraud data for patterns that would reveal which merchants got hacked. Visa and MasterCard each have systems in place for the banks to recover at least a portion of the costs associated with retail credit and debit card fraud (such as the cost of re-issuing compromised cards), but the banks still need to be able to tie specific compromised cards to specific merchant breaches.

Assuming we are seeing an increased incidence of this type of fraud, why might that be the case?

One possible answer is that fraudsters realize that the clock is ticking and that U.S. retailers may not always be such a lucrative target. Much of the retail community is working to meet an October 2015 deadline put in place by MasterCard and Visa to move to chip-and-PIN enabled card terminals at their checkout lanes. Somewhat embarrassingly, the United States is the last of the G20 nations to adopt this technology, which embeds a small computer chip in each card that makes it much more expensive and difficult (but not impossible) for fraudsters to clone stolen cards.

That October 2015 deadline comes with a shift in liability for merchants who haven’t yet adopted chip-and-PIN (i.e., those merchants not in compliance could find themselves responsible for all of the fraudulent charges on purchases involving chip-enabled cards that were instead merely swiped through a regular mag-stripe card reader at checkout time).

When is enough enough already for the bad guys?

I haven’t found anyone who seems to know the answer to this question, but I’ll take a stab: There appears to be a fundamental disconnect between the fraudsters incentivizing these breaches/selling these cards and the street thugs who end up buying these stolen cards.

Trouble is, in the wake of large card breaches at Target, Michaels, Sally Beauty, P.F. Chang’s, et. al., the underground market for these cards would appear to most observers to be almost completely saturated.

For example, in my own economic analysis of the 40 million cards stolen in the Target breach, I estimate that the crooks responsible for that breach managed to sell only about 2-4 percent of the cards they stole. But that number tells only part of the story. I also spoke with a number of banks and asked them: Of the cards that you were told by Visa and MasterCard were compromised in the Target breach, what percentage of those cards did you actually see fraud on? The answer: only between three and seven percent!

So, while the demand for all but a subset of cards issued by specific banks may be low (the crooks buying stolen cards tend to purchase cards issued by smaller banks that perhaps don’t have such great fraud detection and response capabilities), the hackers responsible for these breaches don’t seem to care much about the basic laws of supply and demand. That’s because even a two to four percent sales ratio is still a lot of money when you’re talking about a breach involving millions of cards that each sell for between $10 to $30.

Here is a link to AB Acquisition LLC’s statement on this latest breach.

[bungholio]

I always wonder if the credit card machine here at my workplace has been compromised for years. It acts bizarre and randomly says there was an error in sending data. It also somehow "randomly" has typos, and I don't know how a machine gets typos like instead of asking "Correct?" I've seen it say "Correkt?" and other typos. A machine doesn't just give you strange typos when it randomly tells you data couldn't be sent. I always think it's been sent somewhere else.

[Hacc]

A POS is going to be a POS, regardless. The software might be corrupt due to a hack, or an improper shutdown. You should give it a good tap (HP or HK recommended), or notify someone (if you didn't already).

Breaches suck but an eye-opener for the companies lax on security (no login or default/common password, for example). Some companies (hotels, for example) give you a "discount", if you use a debit or credit card. The price given on having cash in hand only, would prompt some individuals to cause harm, or just walk away (if their sanity levels lower fast enough). The "D(ebit)C(redit)O(ver)M(oney)" effect doesn't look to be slowing down anytime soon, despite EMV being implemented on a wider scale in the States now.