Malware is becoming part of doing business in today’s techno-driven world.
Eddie Bauer is the latest retailer to be compromised by cybercriminals, the retailer disclosed Thursday. According to CNN Money, malware has infiltrated its in-store point-of-sale systems, granting cybercriminals access to customer payment card information on purchases made on various dates between Jan. 2 and July 17 at approximately 350 stores. Cards used for online purchases at eddiebauer.com were not affected, according to the outdoor apparel retailer.
“We have been working closely with the FBI, cybersecurity experts, and payment card organizations, and want to assure our customers that we have fully identified and contained the incident and that no customers will be responsible for any fraudulent charges to their accounts,” Eddie Bauer CEO Mike Egeck said in a statement. “In addition, we’ve taken steps to strengthen the security of our point of sale systems to prevent this from happening in the future.”
Eddie Bauer hired third-party digital forensic experts to investigate the matter, who found that the card data breach was part of a much larger coordinated attack on a range of retailers, restaurants and hotels. But while the retailer was quick to reassure customers, stating “While not all transactions during this period were affected, out of an abundance of caution, Eddie Bauer is offering identity protection services to all customers who made purchases or returns during this period,” some feel the chain is not doing enough.
Cyber security expert Brian Krebs called out the retailer in his blog, KrebsonSecurty, stating “Given the volume of point-of-sale malware attacks on retailers and hospitality firms in recent months, it would be nice if each one of these breach disclosures didn't look and sound exactly the same." According to his blog, he reached out to Eddie Bauer on July 5 after detecting a pattern of fraudulent charges on cards that had recently been used at Eddie Bauer stores, but the store was not eager to delve into the issue.
The rise is breaches may be attributed to a growing sense of hubris on the part of retailers, as Innovative Retail Technologies reported. A recent study found that there was a great disconnect between perceptions and reality in retail cybersecurity, a factor that could help perpetuate the incidence of cyberattacks. According to a report by Arbor Networks, it takes retailers an average of 197 days to detect advanced threats on their networks. However, Tripwire’s 2016 retail cyber security survey found that ninety percent of the respondents believe they could detect a data breach on critical systems in one week or less. In 2014, seventy percent of respondents believed they could detect a breach in one week or less. One third of the retailers surveyed by Tripwire reported that their company had experienced a breach in the previous year, up from 14 percent in 2014. Despite the rise in frequency of attacks, implementation of breach detection technology remained flat.
“Unfortunately, these results indicate that we can expect retail breach activity to continue in the future,” said Tim Erlin, director of IT security and risk strategy. “The increase in confidence connected with speed of breach detection is particularly surprising, especially in combination with partial implementation of detection tools. Together these results indicate while retail organizations might feel better about their cyber security capabilities, there’s still a long way to go to close the gap between initial compromise and detection.”
