Kmart Latest Victim of Payment Data System Breach.

[Anak]

Kmart Investigating Payment System Breach - October 10, 2014

To Our Members,

I am reaching out to inform our loyal Kmart customers of a recent payment security incident. On Thursday, Oct. 9, 2014 our IT team detected that our Kmart store payment data system had been breached and immediately launched a full investigation working with a leading IT security firm. The security experts report that beginning in early September, the payment data systems at Kmart stores were purposely infected with a new form of malware (similar to a computer virus). This resulted in debit and credit card numbers being compromised.....

Source: - Kmart

More from the holding Company; Sears Holdings:

Kmart Investigating Payment System Intrusion

Company Working With Leading Security Experts - Oct 10, 2014

HOFFMAN ESTATES, Ill., Oct. 10, 2014 /PRNewswire/ -- On Thursday, Oct. 9, Kmart's Information Technology team detected our payment data systems had been breached and immediately launched a full investigation working with a leading IT security firm.....

Source: Sears Holdings Corporation Press Releases - Company News

 

[andrew129260]

I had a feeling they were going to get hit. It's going to get much worse I think. It sucks.

 

[lehnerus2000]

Here in Australia (at least in SA) they've just started forcing everyone to use a PIN code instead of signature.
Apparently it increases security.

 

[fireberd]

Who shops at K Mart? The one here has a mostly empty parking lot. I'm surprised its still open.

 

[Borg 386]

It's really something with all the breaches lately. It's no longer a matter of "if", but "when" you card will take a hit due to security breaches at a store. You really have to keep an eye on your card usage nowadays.

You can add Dairy Queen to the list of stores hit.

Data Breach Bulletin: Dairy Queen, JP Morgan Chase, AT&T - Forbes

 

[Anak]

It seems pandemic in our society today that everyone takes a laissez faire attitude towards everything because it will cost more to make changes.

If your neighbor loses his job it's a recession; If I lose mine it's a depression.....

The Smart Cards are finally coming to the States, but not until late next year. They are somewhat more secure, but the bad guys have had a head start trying to crack them in the EU where they've been employed for 10years.
By the way, if you read my first link from gizmodo, read the link about the HVAC maintenance man causing the breach at Target. That is unreal how that came about, and all to save Target a buck.

It's not that secure if it's a magnectic and PIN, chip and PIN is supposed to be the most secure, but that has its detractors: Researchers say chip and pin credit card authentication presents fraud risk | The Verge

I can't find it now, but the financial institutions and card industry's are considering rotating PINs for sales that's supposed to be even better than using a static PIN, how their going to do that, I'm not sure. I believe it was explained in the link I can't find that the rotating PIN would be tied to the chip, vendor, and bank.

I was just in there yesterday, but I paid cash, the reports say this started early Sept. my last credit transact was early Aug.
It doesn't look good for Sears Holding Company: Sears Vendor Said to Halt Shipments as Insurers Back Away - Bloomberg
SHLD started the week at 28.50 and closed Friday at 24.78: https://www.google.com | Sears Holding Company

For those that are unaware, Sears owns Kmart.


Oh No!! Not dairy Queen, Damn!

Well, my bank just open and I'm going up to talk to them about this, and check on creating some specialized alerts. Might have to change some numbers. Oh well better safe than sorry.

 

[Berton]

The Smart Cards are finally coming to the States, but not until late next year

Is that the card with the RFID chip? Saw such a card used in a US Wal*Mart yesterday by a Canadian visitor, told me it's common now there.

 

[lehnerus2000]

That is unreal how that came about, and all to save Target a buck.

It's a systemic problem these days.

The theory used to be:

1. Identify a need
2. Sell a product to fill that need
3. Make a profit

Nowadays it's:

1. Make a profit

All of these new convenience payment systems are inherently insecure.

People are just starting to worry about that PayWave system.
It was obvious before it was introduced that it was a disaster waiting to happen.

I blame a certain government for "rubber stamping" any stupid idea that businesses claim will increase their profits.
Once that government ignores an issue our local politicians say, "it's been approved overseas, so it must be good."

Of course when it goes wrong, tax payers have to "foot the bill" for cleaning up the mess that businesses cause.

That nameless government should say, "You can introduce this idea if you like. If there are any issues the BoD will be hit with multi-billion dollar fines, regardless of who's actually responsible."

 

[Ranger4]

That is unreal how that came about, and all to save Target a buck.

It's a systemic problem these days.

The theory used to be:

1. Identify a need
2. Sell a product to fill that need
3. Make a profit

Nowadays it's:

1. Make a profit

All of these new convenience payment systems are inherently insecure.

People are just starting to worry about that PayWave system.
It was obvious before it was introduced that it was a disaster waiting to happen.

I blame a certain government for "rubber stamping" any stupid idea that businesses claim will increase their profits.
Once that government ignores an issue our local politicians say, "it's been approved overseas, so it must be good."

Of course when it goes wrong, tax payers have to "foot the bill" for cleaning up the mess that businesses cause.

That nameless government should say, "You can introduce this idea if you like. If there are any issues the BoD will be hit with multi-billion dollar fines, regardless of who's actually responsible."

I agree with you 100%. We now have sectional interest governments & the rest of the electorate can go to hell.

 

[Anak]

Berton:
From my understanding the smart cards you referenced to in my link do not have the rfid technology.

Did you notice if your Canadian acquaintance had protection for his/her card? I've seen articles where it says the rfid card needs to be within 1 to 2"s of the card reader, but thieves have readers that can pick them up from 30' away.
If you click on the link at the top it will take you to this site's security apparel for rfid cards.
RFID Protection Explained | Corporate Travel Safety

On my reference about the 10year lead for hackers in Europe, this was 4years ago:
German gov pooh-poohs biometric ID card hack ? The Register

lehnerus:

Of course when it goes wrong, tax payers have to "foot the bill" for cleaning up the mess that businesses cause.

Talk about footing the bill, this is the thanks we got: Appraising the Farcical Hank Greenberg-AIG Trial: Four Blunt Points - Businessweek

I liked how Stewart ripped into Greenburg, the 9:58 will go by quickly:
Lawsuits of the Rich and Shameless - The Daily Show - Video Clip | Comedy Central

Ranger4:
I refuse to believe the "Good 'ol Boy" system of governing has died.


On the visit to my credit union (CU):
Since it was Saturday I could only talk to the tellers, (the manager was busy with a loan app), but come Monday I have the direct number to contact the loss prevention (LP) dept.

The tellers told me that LP is already in contact with Kmart and will cross reference the breached card numbers Kmart has with card numbers in the CU system and if there are any matches the card would be immediately invalidated, the card holder would be contacted and a new card issued. In the mean time we have to keep an eye on our accounts.
My first question to LP is; For how long? Then, When are the new smart cards being issued? And, I want to ask them their opinion about a security program I came across, and have been using: IBM Security Trusteer Rapport | Trusteer

It creates a tunnel or VPN between you and any other web site you go to. Yes, any other. The protection can be individually turned on or off at any time, I'm using it for my banking and email provider. I have Zemana Pro and there haven't been any conflicts.

One caveat: there have been complaints on security web sites that the user didn't like the program or it caused conflicts. If you do install it, and want to uninstall you will need a download from Trusteer to uninstall it completely.

 

[Berton]

When I asked the traveler if it had the RFID chip, he said it did. And for the distance, he was holding it as he inserted it into the bottom of the card reader. He also said he could use it with the swipe of older readers.

 

[Anak]

I saw that earlier, it's to allow the card holder to use the card at vendors that do not have a rfid reader. It's still vulnerable.

From the fourth paragraph down:

RFID-enabled cards retain their magnetic stripe, so they can be used with existing point-of-sale terminals. Therefore, the information is still vulnerable. But the chip in the RFID transponder has additional security features that credit-card companies say make it more secure.

Source: RFID Journal Blog - RFID Journal

All the new smart cards have their drawbacks, but I would feel safer with chip and pin or chip and sig, not rifd in any form.

 

[BrightBlessings]

That is unreal how that came about, and all to save Target a buck.

It's a systemic problem these days.

The theory used to be:

1. Identify a need
2. Sell a product to fill that need
3. Make a profit

Nowadays it's:

1. Make a profit

All of these new convenience payment systems are inherently insecure.

People are just starting to worry about that PayWave system.
It was obvious before it was introduced that it was a disaster waiting to happen.

I blame a certain government for "rubber stamping" any stupid idea that businesses claim will increase their profits.
Once that government ignores an issue our local politicians say, "it's been approved overseas, so it must be good."

Of course when it goes wrong, tax payers have to "foot the bill" for cleaning up the mess that businesses cause.

That nameless government should say, "You can introduce this idea if you like. If there are any issues the BoD will be hit with multi-billion dollar fines, regardless of who's actually responsible."

Is why I still have a bank book/passbook and pay only cash for what I want/need. I have a visa debit card unrelated to my main account into which I put money if I want to buy anything online. But then I was raised to only pay cash or go without. Doesn't stop the banks from offering me credit cards with limits of up to and including 20 and 30K.

 

[lehnerus2000]

Doesn't stop the banks from offering me credit cards with limits of up to and including 20 and 30K.

Banks are %^&*&%%^#$$@#%^&% (I can't think of any words that would adequately express my contempt and disgust).

I went into my bank the other day to deposit a cheque.
The teller casually mentioned that my account pays 0.3% interest and suggested that I open a new high interest account.
When I originally opened it, it was a high interest account.
The interest from it used to cover 50% of the charges that my other account attracts.

Q - What is the difference between Corporations and Organised Crime?
A - The Government backs up (and sucks up to) Corporations.

 

[BrightBlessings]

I think there's a professional jealousy thing going on between them two mobs.

 

[lehnerus2000]

I think there's a professional jealousy thing going on between them two mobs.

:roflmao: