Top Tech News

CIO Today Network Sites:   Top Tech News  |   CIO Today   |   Mobile Tech Today   |   Data Storage Today
News & Product Reviews for Tech Leaders
Sunday, April 20th 
24/7/365 Network Uptime!
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Trending Topics:   Security Heartbleed Big Data Cloud Computing Windows XP Data Centers OS X Mavericks
Home
Network Security
Tech Trends
Cloud Computing
Hardware
Applications
Microsoft/Windows
Apple/Mac
Mobile Tech
World Wide Web
Big Data
Communications
Hackers
Chips & Processors
Linux/Open Source
Personal Tech
Press Releases
 
Free Newsletters
Top CIO News
 
Mobile Tech Today
 

Hackers

Barnes & Noble Says Card Readers at 63 Stores Breached

Barnes & Noble Says Card Readers at 63 Stores Breached
October 24, 2012 2:05PM

Bookmark and Share
Tampered PIN pads were discovered in Barnes & Noble stores in California, Connecticut, Florida, Illinois, Maine, New Jersey, New York, Pennsylvania and Rhode Island. Barnes & Noble said customers who swiped cards at stores in any of those states should change their PINs and review accounts for unauthorized transactions.

BMC is redefining the relationship between I.T. and business. Now I.T. can provide easy access to business services, support and applications -- anywhere, anytime, and from any device. Meaning a more efficient business and an even more innovative I.T. Learn more here.

Barnes & Noble is sounding the alarm on Wednesday about a security breach. The book seller said it had detected tampering with PIN pad devices used in 63 of its stores.

After Barnes & Noble detected that one PIN pad was compromised in each of the 63 stores, it stopped using all PIN pads at nearly 700 stories across the country. The bricks-and-mortar chain also contacted federal law enforcement authorities and is working with authorities to investigate the breach.

"The tampering, which affected fewer than 1 percent of PIN pads in Barnes & Noble stores, was a sophisticated criminal effort to steal credit card information, debit card information, and debit card PIN numbers from customers who swiped their cards through PIN pads when they made purchases," the company said in a statement. "This situation involved only purchases in which a customer swiped a credit or debit card in a store using one of the compromised PIN pads."

Bugs Planted in PIN Pads

Barnes & Noble made clear that its customer database is secure. Purchases on Barnes & Noble.com, NOOK and NOOK mobile apps were not affected by the breach. The member database was also not affected, and none of the affected PIN pads was discovered at Barnes & Noble College Bookstores.

"The criminals planted bugs in the tampered PIN pad devices, allowing for the capture of credit card and PIN numbers," the company said after its internal investigation. "Barnes & Noble disconnected all PIN pads from its stores nationwide by close of business Sept. 14, and customers can securely shop with credit cards through the company's cash registers."

Tampered PIN pads were discovered in California, Connecticut, Florida, Illinois, Maine, New Jersey, New York, Pennsylvania and Rhode Island. Barnes & Noble said customers who swiped cards at stores in any of those states should change their PIN numbers, review accounts for unauthorized transactions and notify their banks immediately if they discover any unauthorized purchases or withdrawals.

Evidence of Inside Job

Gunter Ollmann, vice president of research at Damballa, said his initial investigation leads him to believe an insider was responsible. Specifically, he told us the breach appears to be a physical manipulation of the card readers in order to steal both debit card details and their accompanying personal identification numbers.

"This kind of fraud and their related tamper-resistance bypassing techniques would likely have been combated through the use of the chip and PIN technology commonly used in Europe and the Asia-Pacific," Ollman told us. "However, even these more advanced technologies have a number of flaws, but they make it considerably more difficult for criminals where it comes to cloning the victims cards and making fraudulent charges."

Based upon what Barnes & Noble has disclosed, Ollman believes the breach is an insider threat perpetrated by criminals who had physical access to the card readers. The evidence does not suggest that a batch of card readers were compromised at the manufacturer or distribution center.

"The criminals would have most likely had repeated access to the card readers -- and/or supporting computer systems -- in order to obtain the collected credentials," Ollman said. "It has been stated that only one reader per store was affected, which doesn't smell of a supply chain problem."

Tell Us What You Think
Comment:

Name:



 Hackers
1. Teen Arrested for Heartbleed Hack
2. iPad Hacker Conviction Overturned
3. Is Heartbleed the Biggest Threat Ever?
4. Heartbleed Bug Breaks Web Security
5. Retailers Liable for Hacking Damage?




 Most Popular Articles
1. $200 'Micro' 3D Printer Earns Big on Kickstarter
2. Fast Seagate 6 TB Drive Offered for Enterprise Data Centers
3. Resetting All Passwords Now May Be Worst Heartbleed Fix
4. Is Heartbleed the Biggest Web Security Threat Ever?
5. Silverpop: IBM Marketing Portfolio Gets Personal

Have an informed opinion on this story?
Send a Letter to the Editor.
We want to know what you think.
Send us your Feedback.

 Related Topics  Latest News & Special Reports

  Cortana Fills Windows Phone Gap
  Galaxy S5 Phone: Less Can Be More
  Beware: Facebook Shares Your Locale
  Heartbleed Exploit Could Cost Millions
  Poll: A Mix of Feelings on Future Tech

 Technology Marketplace
Business Intelligence
Get real-time, cloud-based information services with Neustar.
 
Cloud Computing
Next Generation Data Center Is Here! Vblock™ Systems from VCE
 
Contact Centers
HP delivers the future of the contact center with HP Qfiniti 10.
 
Data Storage
Next Generation Data Center Is Here! Vblock™ Systems from VCE
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Enterprise Hardware
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Hardware
Protect your network with APC Smart-UPS battery backup
 
Network Security
Protect your network with APC Smart-UPS battery backup
 

Network Security Spotlight
Heartbleed Could Cost Millions, Could Have Been Prevented
Early estimates of Heartbleed’s cost to enterprises are running in the millions. The reason: revoking all the SSL certificates the bug exposed will come at a very hefty price. Some say it all could have been avoided.
 
Michaels Says Nearly 3M Credit, Debit Cards Breached
Arts and crafts retail giant Michaels Stores has confirmed that a data breach at its POS terminals from May 2013 to Jan. 2014 may have exposed nearly 3 million customer credit and debit cards.
 
Google's Street View Software Unravels CAPTCHAs
The latest software Google uses for its Street View cars to read street numbers in images for Google Maps works so well that it also solves CAPTCHAs, those puzzles designed to defeat bots.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
The innovative headpiece may find its niche in markets where hands-free access to data can be a big advantage. Glass experiments for doctors are already under way, with some promising results.
 

Mobile Technology Spotlight
Review: Siri-Like Cortana Fills Windows Phone Gap
With the new Cortana virtual assistant, Windows catches up with Apple's iOS and Google's Android in a major way, taking some of the best parts of Apple's and Google's virtual assistants, with new tools too.
 
With Galaxy S5, Samsung Proves Less Can Be More
Samsung has produced the most formidable rival yet to the iPhone 5s: the Galaxy S5. The device is the fifth edition of the company's successful line of Galaxy S smartphones, and shows less can be more.
 
Facebook Rolls Out Potentially Intrusive Location-Sharing
Looking for friends? Facebook users in the U.S. will soon be able to see which of their friends are nearby, using a smartphone's GPS. Could be a cool feature in some cases, or way too much information.
 

Navigation
Top Tech News
Home/Top News | Network Security | Tech Trends | Cloud Computing | Hardware | Applications | Microsoft/Windows
Apple/Mac | Mobile Tech | World Wide Web | Big Data | Communications | Hackers | Chips & Processors
Linux/Open Source | Personal Tech | Press Releases
Also visit these Enterprise Technology Sites
Top Tech News | CIO Today | Mobile Tech Today | Data Storage Today

Services:
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About CIO Today Network | How To Contact Us | Article Reprints | Services for PR Pros (In partnership with NewsFactor) | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 Top Tech News. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.