Grocery terminals slurped payment card data
Two months undetected
Agentless Backup is Not a Myth
Grocery chain Aldi Inc. has warned customers in 11 states that their payment card data may have been slurped up by point-of-sale terminals that were illegally planted by identity thieves.
The tampered terminals were in use from June 1 to August 31 in an undisclosed number of stores, the company disclosed in a press release (PDF) that appeared on a Friday, a favorite day of the week for releasing bad news. As many as 1,000 Aldi shoppers in Illinois and Indianapolis have already reported fraudulent charges, according to Computer World.
The breach is noteworthy for the breadth of the affected geography, which spanned from New York state to Georgia to as far west as Illinois. Presumably, those responsible would have had to travel to each store to physically plant the hardware used to siphon personal identification numbers, card numbers and names.
PINs are generally encrypted as they pass from the terminal to the payment processor, so they have to be captured using cameras or keyboard overlays that capture the secret code before it's encrypted.
Aldi, which has about 1,100 stores in 31 states, said it believes all the tampered terminals have been removed. ®
COMMENTS
This is why the banks are...
Banks have been brainwashing people into thinking that chip and pin is foolproof and the only way there could be problems is if you deliberately tell someone else your pin number, or if you don't cover your pin. They just refuse to accept that there could be dodgy terminals, or that it may be retrieved using some other special techniques. They come on the news when anything happens with chip and pin and say it is the customers' fault. They have deliberately refused to accept that there is a flaw in the system.
Could me a large number of people hit.
"Presumably, those responsible would have had to travel to each store to physically plant the hardware used to siphon personal identification numbers, card numbers and names."
No, I expect the terminals were modified before they were shipped to the store. Some place between where they were made (likely China) and final distribution. The same thing was reported in the UK some time ago.
The skimming terminals were active for months, they could have collected a lot of card details before they started using them (and the scam was detected).
stick to cash
It is my favourite near field payment method, and if you move your hands carefully it can be contactless too!!!
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
