Target, Neiman Marcus not only US retailers to have networks hacked
At least three others, along with Target and Neiman Marcus, said to have their networks compromised over holiday shopping season
Target and luxury chain Neiman Marcus are not the only US retailers whose networks were breached over the holiday shopping season last year, according to sources familiar with attacks on other merchants that have yet to be publicly disclosed.
Smaller breaches on at least three other well-known US retailers took place and were conducted using similar techniques as the one on Target, according to the people familiar with the attacks. Those breaches have yet to come to light. Also, similar breaches may have occurred earlier last year. The sources said they involved retailers with outlets in malls.
They also said that while they suspect the perpetrators may be the same as those who launched the Target attack, they cannot be sure because they are still trying to find the culprits behind all of the security breaches.
Law enforcement sources have said they suspect the ring leaders are from Eastern Europe.
Only one well-known retailer, Neiman Marcus, has said that it too has been victim of a cyber attack since Target's December 19 disclosure that some 40 million payment card numbers had been stolen in a cyber attack. On Friday, Target said the data breach was worse than had initially been thought.
An investigation found that hackers stole the personal information of at least 70 million customers, including names, mailing addresses, telephone numbers and e-mail addresses. Neiman Marcus said it was not sure if the breach was related to the Target incident.
Most states have laws that require companies to contact customers when certain personal information is compromised. In many cases the task of notification falls on the credit card issuer.
Merchants are required to report breaches of personal information including social security numbers. It was not immediately clear if that was the case with the retailers who were attacked around the same time as Target.
The Secret Service and Department of Justice, which are investigating the Target breach, declined to comment on Saturday.
Target has not disclosed how the attackers managed to breach its network or siphon off some of its most sensitive data.
The sources who spoke about the breaches said that investigators believe the attackers used similar techniques and pieces of malicious software to steal data from Target and other retailers.
One of the pieces of malware they used was something known as a RAM scraper, or memory-parsing software, which enables cyber criminals to grab encrypted data by capturing it when it travels through the live memory of a computer, where it appears in plain text, the sources said.
While the technology has been around for many years, its use has increased in recent years as retailers have improved their security, making it more difficult for hackers to obtain credit card data using other approaches.
Visa issued two alerts last year about a surge in cyber attacks on retailers that specifically warned about the threat from memory parsing malware. The alerts provided retailers with technical details on how the attacks were launched and advice on thwarting them.
Yet a law enforcement source familiar with the breach said that even if the retailer had implemented those steps, the efforts may not have succeeded in stopping the attack.
That is because the attackers were more sophisticated than the ones in the previous attacks described in the Visa alerts, according to the source.