Feeds

Hackers slurp credit card details from US luxury retailer Neiman Marcus

Meanwhile, 2 million 'high value' cards were just dumped on black market - fraud-watcher...

5 things you didn’t know about cloud backup

Upmarket US department store Neiman Marcus has been hit by hackers who broke into systems before lifting an as-yet-unspecified number of credit and debit card details.

Neiman Marcus confirmed a security breach in a series of updates to its official Twitter account and apologised, without detailing the extent of the problem or commenting on its possible cause.

"The security of our customers' information is always a priority and we sincerely regret any inconvenience," the retailer said, before adding "we are taking steps, where possible, to notify customers whose cards we know were used fraudulently after purchasing at our stores."

Neiman Marcus provided a longer statement to investigative journalist Brian Krebs, who first reported the breach.

Neiman Marcus was informed by our credit card processor in mid-December of potentially unauthorised payment card activity that occurred following customer purchases at our Neiman Marcus Group stores.

We informed federal law enforcement agencies and are working actively with the U.S. Secret Service, the payment brands, our credit card processor, a leading investigations, intelligence and risk management firm, and a leading forensic firm to investigate the situation. On January 1st, the forensics firm discovered evidence that the company was the victim of a criminal cyber-security intrusion and that some customers’ cards were possibly compromised as a result.

We have begun to contain the intrusion and have taken significant steps to further enhance information security.

The security of our customers’ information is always a priority and we sincerely regret any inconvenience. We are taking steps, where possible, to notify customers whose cards we know were used fraudulently after making a purchase at our store.

Daniel Ingevaldson, CTO at fraud protection firm Easy Solutions, said fraud-watchers noticed a big dump of around two million high-value cards hitting the black market around the start of the year, something he theorised on Friday might have come from the Neiman Marcus breach.

"On Jan 4th, we saw a dump of 2 million cards onto the black market - one of the largest single day drops we've seen in a while. While we can't definitively say what the source of the breach was, the percentage of Extremely High Value cards is significantly higher than we see on average," Ingevaldson said in a blog post. "These are cards like the Amex Centurion card - an invite-only card that comes with a $7,500 setup fee and $2,500 annual fee. While it is hard to determine from a single black market, this would indicate these could come from a high end source, such as Neiman Marcus."

The latest attack against a high-profile US retailer dates from the middle of the Christmas shopping season, around the same time as a massive breach against US chain Target that resulted in the theft of 40 million credit and debit card records as well as 70 million sets of personal information.

Sources in the information security industry are telling El Reg that the Target breach involved installing malware on point-of-sale systems, a theory that's consistent with media statements by Target chief exec Gregg Steinhafel over the weekend.

Reuters reports investigators as saying that the Target and Neiman Marcus breaches have several features in common with each other – as well as with a series of hacks over the holiday season that also affected three other retailers in less significant breaches. The latter breaches are likely to become public over the next few days or so. Sources told the news agency that the as-yet-unidentified attackers used similar techniques and malware to siphon the data, prompting some to speculate that all of the incidents could be linked. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.