Neiman Marcus security breach puts 1.1M cards at risk

Retailer was hit by malware from July to October last year, so far 2,400 cards used fraudulently

Everyone has been talking for weeks about the giant security breach at Target  this past holiday season, but they are not the only retailer that was hit. A number of other, well-known retailers have also been hit.

So far, though, the only one of those retailers to have so far come forward to admit that it had been hit by hackers has been Neiman Marcus.

The company released an apology to its customers, along with some data about how many customers were hit.

Starting on July 16th of last year, and stretching all the way until the end of October, 1.1 million customers at the retailer were potentially exposed to malware, though the company says that only 2,400 cards have so far been used fraudulently.

The company says that it became aware of the situation on January 1st of this year, though it is not sure how many stores were affected. 

Obviously that 1.1 million number is much lower than the 70 million that were potentially victims of the Target hacking, but it is still nothing to sneeze at. Neiman Marcus, however, denied that there was any link between the two incidents, saying it had "no knowledge of any connection to that situation."

There is some good news for Neiman Marcus shoppers, though. First, the retailer says no social security numbers and birth dates were not compromised. 

If the customer paid with Neiman Marcus and Bergdorf Goodman cards, or bought online, they were probably not affected. Also, no PINs were ever at risk "because we do not use PIN pads in our stores."

"We deeply regret and are very sorry that some of our customers' payment cards were used fraudulently after making purchases at our stores. We have taken steps to notify those affected customers for whom we have contact information," Karen Katz, the President and CEO of Neiman Marcus Group, wrote in an open letter to the stores customers. 

"We aim to protect your personal and financial information. We want you always to feel confident shopping at Neiman Marcus, and your trust in us is our absolute priority."

Earlier this week The Department of Homeland Security released a report on the attacks that compromised Target and Neiman Marcus shoppers.

It revealed that the Target breach came from an advanced piece of software called POSRAM Trojan, which is also responsible for other attacks on retailers’ point-of-sale systems. POSRAM is a memory scraper that captures data stored on a card’s magnetic stripe in the moment when it’s swiped through the terminal and the data is still in the system’s memory. Data that’s encrypted appears in plain text.

Though Neiman Marcus says that there is no connection between the two breaches, it was also hit by a similar type of memory-scraping malware.

The company says that it is taking steps to "contain the situation," including working with federal law enforcement agencies, conducting reviews of its payment systems, doing a vulnerability assessment with its payment brands, reinforcing its security tools and modifying it software and security credentials.

our merchant processor, a leading investigations, intelligence and risk management firm, and a leading payment brand–approved forensics firm 

It will also, of course, be "searching for and disabling all malware we discover in the course of our investigation."

(Image source: https://fox5sandiego.com)