Tuesday, April 08, 2008
Hannaford Data Breach Blamed On Malware
Hannaford Data Breach Blamed On Malware
The grocer said the data breach involved malicious software that was found on computer servers at about 300 of the company's stores.
By Thomas Claburn
InformationWeek
April 1, 2008 04:30 PM
The theft of an estimated 4.2 million credit and debit card numbers from Hannaford Bros. grocery stores in the New England area appears to be the result of malware.
In a letter cited by The Boston Globe from Hannaford Bros. to Massachusetts Attorney General Martha Coakley and the state's Office of Consumer Affairs and Business Regulation, the company said that the data breach it disclosed on March 17 involved malicious software that was found on computer servers at about 300 of the company's stores.
The software reportedly intercepted credit card data during checkout and sent captured information overseas, according to the letter.
Carol Eleazer, VP of marketing for Hannaford Bros., confirmed that a letter had been sent to the Massachusetts attorney general and that the facts reported were essentially accurate. She noted that the fix deployed involved software, and not the replacement of hardware. "It was a software problem and it took a software fix," she said.
Eleazer had no further information to provide about the incident, citing ongoing law enforcement and internal forensic investigations.
The breach occurred between Dec. 7 and March 10. Hannaford Bros. said it detected the breach on Feb. 27.
Coakley last month urged consumers who made a purchase at Hannaford stores during this period to watch out for unauthorized use of their credit or debit card numbers and to take steps to safeguard their personal information.
While Hannaford has acknowledged that up to 4.2 million credit and debit card numbers were compromised, it said there's no evidence to indicate that cardholder names and addresses were stolen. The company has said it continues to investigate the incident. The Secret Service is conducting its own investigation.
"In this case, it looks like the hackers exploited the weakest link," said Chris Andrew, VP of security technology at Lumension, a security management company.
Slavik Markovich, CTO of database security company Sentrigo, observes that the attack is unusual in that the thieves attacked the endpoints of the network, rather than accessing the endpoints to reach a central data repository. He said he believes the attack was specially crafted to affect Hannaford's systems.
In its letter, according to The Boston Globe, Hannaford said it had been certified in February to be compliant with the Payment Card Industry security standard, known as PCI.
But Lumension's Andrew cautioned that PCI standards are just guidelines that are open to interpretation. He said stores still need to invest in their own security programs. "Retail is a sector which is not known for high-security in particular," he said. "It's not military networks, it's not banks."
Maybe it should be. Fred Pinkett, VP of product management at security auditing company Core Security Technologies, expects that the retail industry will be targeted with similar attacks in the future. "It's where the money is," he said. "The security landscape has shifted from people trying to make a name for themselves to people trying to keep hidden. You definitely will see more attacks."
Pinkett argues that penetration testing is critical. "We would suggest that companies have a good penetration regime in place so they can find the vulnerabilities in their systems before the hackers do," he said.
Sentrigo's Markovich advised that companies hoping to avoid a similar fate use standard tools to encrypt all of their network traffic, rather than select traffic, as Hannaford reportedly did. He also suggested using activity-monitoring systems on the network and database, in conjunction with periodic network and endpoint audits.
The grocer said the data breach involved malicious software that was found on computer servers at about 300 of the company's stores.
By Thomas Claburn
InformationWeek
April 1, 2008 04:30 PM
The theft of an estimated 4.2 million credit and debit card numbers from Hannaford Bros. grocery stores in the New England area appears to be the result of malware.
In a letter cited by The Boston Globe from Hannaford Bros. to Massachusetts Attorney General Martha Coakley and the state's Office of Consumer Affairs and Business Regulation, the company said that the data breach it disclosed on March 17 involved malicious software that was found on computer servers at about 300 of the company's stores.
The software reportedly intercepted credit card data during checkout and sent captured information overseas, according to the letter.
Carol Eleazer, VP of marketing for Hannaford Bros., confirmed that a letter had been sent to the Massachusetts attorney general and that the facts reported were essentially accurate. She noted that the fix deployed involved software, and not the replacement of hardware. "It was a software problem and it took a software fix," she said.
Eleazer had no further information to provide about the incident, citing ongoing law enforcement and internal forensic investigations.
The breach occurred between Dec. 7 and March 10. Hannaford Bros. said it detected the breach on Feb. 27.
Coakley last month urged consumers who made a purchase at Hannaford stores during this period to watch out for unauthorized use of their credit or debit card numbers and to take steps to safeguard their personal information.
While Hannaford has acknowledged that up to 4.2 million credit and debit card numbers were compromised, it said there's no evidence to indicate that cardholder names and addresses were stolen. The company has said it continues to investigate the incident. The Secret Service is conducting its own investigation.
"In this case, it looks like the hackers exploited the weakest link," said Chris Andrew, VP of security technology at Lumension, a security management company.
Slavik Markovich, CTO of database security company Sentrigo, observes that the attack is unusual in that the thieves attacked the endpoints of the network, rather than accessing the endpoints to reach a central data repository. He said he believes the attack was specially crafted to affect Hannaford's systems.
In its letter, according to The Boston Globe, Hannaford said it had been certified in February to be compliant with the Payment Card Industry security standard, known as PCI.
But Lumension's Andrew cautioned that PCI standards are just guidelines that are open to interpretation. He said stores still need to invest in their own security programs. "Retail is a sector which is not known for high-security in particular," he said. "It's not military networks, it's not banks."
Maybe it should be. Fred Pinkett, VP of product management at security auditing company Core Security Technologies, expects that the retail industry will be targeted with similar attacks in the future. "It's where the money is," he said. "The security landscape has shifted from people trying to make a name for themselves to people trying to keep hidden. You definitely will see more attacks."
Pinkett argues that penetration testing is critical. "We would suggest that companies have a good penetration regime in place so they can find the vulnerabilities in their systems before the hackers do," he said.
Sentrigo's Markovich advised that companies hoping to avoid a similar fate use standard tools to encrypt all of their network traffic, rather than select traffic, as Hannaford reportedly did. He also suggested using activity-monitoring systems on the network and database, in conjunction with periodic network and endpoint audits.
Labels: Hannaford Bros.
Thieves Steal 4.2 Million Credit And Debit Card Numbers From Supermarket Servers
Thieves Steal 4.2 Million Credit And Debit Card Numbers From Supermarket Servers
Hannaford Bros. CEO Ron Hodge said the data intrusion had been contained and that names and addresses were not accessed.
By Thomas Claburn
InformationWeek
March 18, 2008 03:00 PM
Thieves stole an estimated 4.2 million credit and debit card numbers from the Scarborough, Maine-based Hannaford Bros. and Sweetbay supermarket chains, Hannaford Bros. Co. said on Monday.
In a letter posted on the company Web site, Hannaford Bros. CEO Ron Hodge said that the data intrusion had been contained and that names and addresses were not accessed because the company does not store personally identifiable customer information with transaction data.
As a consequence, the company said it is unable to notify potentially affected customers. The company said it is working with credit and debit card issuers to determine the impact of the stolen data.
"We sincerely regret this intrusion into our systems, which we believe, are among the strongest in the industry," said Hodge. "The stolen data was limited to credit and debit card numbers and expiration dates, and was illegally accessed from our computer systems during transmission of card authorization."
The use of the word "transmission" in Hodge's statement suggests that data may have been intercepted while being transmitted through a wireless system. The Wall Street Journal, citing an unnamed source, said on Tuesday that investigators are looking at Hannaford's wireless system as a possible point of access.
As many as 1,800 cases of fraud have been linked to the data theft, according to the Associated Press.
Hannaford Bros. did not respond to a request for comment. The company is owned by the Delhaize Group, based in Belgium.
The intrusion affected Hannaford Stores in New England and New York, Sweetbay stores in Florida, and some independently-owned retail stores in the Northeast that sell Hannaford products. Hannaford Brothers said that the intrusion was detected on February 27.
The Massachusetts Bankers Association, which represents about 200 financial institutions in New England, said on Monday that Visa and MasterCard had contacted between 60 and 70 banks in Massachusetts about a large data breach that had occurred at "a major retailer." Visa and MasterCard did not name Hannaford Bros. as a matter of policy.
The Hannaford incident is the largest publicly known data breach in the U.S. since September 2007, when hackers accesses 6.3 million Ameritrade customer name and address records. In January 2007, TJX Companies disclosed that data thieves had accessed its servers during the previous year. An estimated 94 million credit and debit card records were stolen.
In December 2007, the Massachusetts Bankers Association said that it had settled its lawsuit against TJX Companies under undisclosed terms.
Hannaford is advising customers to carefully review their credit and debit card statements over the past three months and to contact the issuing institution immediately in the event of any irregularity.
Hannaford has set up a customer assistance line at 866-591-4580.
Hannaford Bros. CEO Ron Hodge said the data intrusion had been contained and that names and addresses were not accessed.
By Thomas Claburn
InformationWeek
March 18, 2008 03:00 PM
Thieves stole an estimated 4.2 million credit and debit card numbers from the Scarborough, Maine-based Hannaford Bros. and Sweetbay supermarket chains, Hannaford Bros. Co. said on Monday.
In a letter posted on the company Web site, Hannaford Bros. CEO Ron Hodge said that the data intrusion had been contained and that names and addresses were not accessed because the company does not store personally identifiable customer information with transaction data.
As a consequence, the company said it is unable to notify potentially affected customers. The company said it is working with credit and debit card issuers to determine the impact of the stolen data.
"We sincerely regret this intrusion into our systems, which we believe, are among the strongest in the industry," said Hodge. "The stolen data was limited to credit and debit card numbers and expiration dates, and was illegally accessed from our computer systems during transmission of card authorization."
The use of the word "transmission" in Hodge's statement suggests that data may have been intercepted while being transmitted through a wireless system. The Wall Street Journal, citing an unnamed source, said on Tuesday that investigators are looking at Hannaford's wireless system as a possible point of access.
As many as 1,800 cases of fraud have been linked to the data theft, according to the Associated Press.
Hannaford Bros. did not respond to a request for comment. The company is owned by the Delhaize Group, based in Belgium.
The intrusion affected Hannaford Stores in New England and New York, Sweetbay stores in Florida, and some independently-owned retail stores in the Northeast that sell Hannaford products. Hannaford Brothers said that the intrusion was detected on February 27.
The Massachusetts Bankers Association, which represents about 200 financial institutions in New England, said on Monday that Visa and MasterCard had contacted between 60 and 70 banks in Massachusetts about a large data breach that had occurred at "a major retailer." Visa and MasterCard did not name Hannaford Bros. as a matter of policy.
The Hannaford incident is the largest publicly known data breach in the U.S. since September 2007, when hackers accesses 6.3 million Ameritrade customer name and address records. In January 2007, TJX Companies disclosed that data thieves had accessed its servers during the previous year. An estimated 94 million credit and debit card records were stolen.
In December 2007, the Massachusetts Bankers Association said that it had settled its lawsuit against TJX Companies under undisclosed terms.
Hannaford is advising customers to carefully review their credit and debit card statements over the past three months and to contact the issuing institution immediately in the event of any irregularity.
Hannaford has set up a customer assistance line at 866-591-4580.
Labels: Hannaford Bros.
