Evan Schuman's StorefrontBacktalk

Genesco, the $1.6 billion North American footwear retailer, confirmed Friday (Dec. 10) that its payment systems had been breached. The theft apparently started with the 2,225-store chain, but neither the number of cards nor whether other chains were impacted was not initially disclosed.

Genesco stores operate in the U.S., Canada and Puerto Rico under quite a few brand names, including Johnston & Murphy, Journeys and Hatworld, in addition to Web operations Undergroundstation and DockersShoes. The chain said it had notified the “major card brands” and law enforcement, which at least indicates that the breach was not discovered by MasterCard or Visa.

Many breaches in recent years have been detected by the card brands’ systems, which then alerted a retailer that it was the common point of purchase in a series of payment card frauds. With other breaches, the Secret Service has alerted retailers that they were hit. If we take the Genesco statement at its literal word, neither happened in this case. That suggests Genesco’s IT operations detected the breaches first, which is how life is supposed to work. It also suggests this doesn’t appear to be a Gonzalez-style 20-retail-chain breach, making it possibly a Genesco-only problem.

Genesco said the “criminal intrusion” only impacted some of its brands: “United States Journeys, Journeys Kidz, Shi by Journeys and Johnston & Murphy stores and some of its Underground Station stores.” The statement also said “the extent of the intrusion is not known at this time” and “we believe that the intrusion has been contained.” It also specified what apparently was stolen.

“It is possible that the credit or debit card number, expiration date and card verification code contained on the magnetic stripe of some payment cards used at stores in the affected chains may have been acquired without authorization during the intrusion,” the Genesco statement said. “The Company currently has no reason to believe that personal information, such as names, addresses or Social Security numbers, was acquired by the intruder. Additionally, the Company has no reason to believe that payment card transactions in any of its E-Commerce or catalog businesses, any of its Lids Sports businesses or any of its Canadian stores were affected by the intrusion.”

Genesco CEO Robert Dennis tried to assure consumers that risks were minimal. “Because we have no reason to believe customers’ personal information was compromised, we do not believe that identify theft is likely as a consequence of the intrusion,” Dennis wrote in a customer letter.

The standard data-breach questions have yet to be answered in the Genesco breach, such as the number of pieces of information stolen, how the thief accessed the data and how old was that card data, which might answer the biggest question: Why was the chain retaining the verification number? Was it a system test that used live data?