NEW
YORK — The security
breach that hit Target during the holiday season appears to have been part
of a broader and highly sophisticated scam that potentially
affected a large number of retailers, according to a report published by a
global cyber intelligence firm that works with the U.S. Secret Service and the
Department of Homeland Security.
The
report, made public Thursday by iSight Partners of Dallas, offers more insight
into the breach at Target. That attack affected 40 million credit and debit
card accounts and led to the theft of personal information, including e-mail
addresses and names, of as many as 70 million customers.
The
report said a malicious program vacuuming personal data from terminals at store
checkout stations was “almost certainly derived” from BlackPOS, a crude but
effective piece of software that contained malware scripts with Russian
origins.
“The
use of malware to compromise payment information storage systems is not new,”
the report said. “However, it is the first time we have seen this attack at
this scale and sophistication.”
[Reuters
reported that on Thursday the U.S. government provided merchants with
information gleaned from its confidential investigation into the data breach at
Target in a move aimed at identifying and thwarting similar attacks that may be
ongoing. ISight helped prepare the report, called “Indicators for Network
Defenders,” along with the Department of Homeland Security’s National Cybersecurity and Communications
Integration Center, the U.S. Secret Service and the Financial Sector
Information Sharing and Analysis Center, an industry security group.]
Starting
in June, iSight said it noticed the malicious software codes on the black
market, the report said.
Criminals
bought the original malware on the black market and then created their own
attack method to target retailers’ terminals at store checkout stations, iSight
chief executive John P. Watters said.
“It’s
less about the malware but more about the sophistication of the attacks,”
Watters said in an interview.
The
iSight report noted that because this kind of software can “cover its own
tracks,” it’s not possible to determine the scale, scope and reach of the
breach without detailed forensic analysis.
“Organizations
may not know they are infected,” the report said. “Once infected, they may not
be able to determine how much data has been lost.”
Last
week, Neiman Marcus said thieves stole some of its customers’ payment
information and made unauthorized charges over the holidays. At the time, it
said it was working with the Secret Service on the breach.
