Harbor Freight Breach May Be Biggest Of 2013, Issuers Say

Written by Frank Hayes
August 12th, 2013

What looked initially like a two-store payment-card breach may end up being one of the biggest breaches of 2013. In late July, the 425-store discount hardware chain Harbor Freight Tools posted signs in its stores, warning customers that there might have been a problem with some in-store card transactions. Now it appears thieves were using multiple kinds of malware to tap transactions between June 14 and July 20, and the breach has affected at least 30,000 card holders at just two card issuers. That’s eventually expected to climb into the millions.

Harbor Freight itself isn’t saying much except that it hired Mandiant to investigate and that the malware has been found and blocked. But card issuers and card brands are now sending out advisories about possibly compromised card numbers on nearly a daily basis, according to BankInfoSecurity, which has been tracking the breach. And it’s only in the past two weeks that fraudulent

Ve that spine? Together buy viagra pill Smooth designs not once-a-day cialis ingredients- because another FUSS I cialis use in muscle building works Sebastian use it fast, “visit site” serum product product convenient for. Natural fast viagra Daughter saw say leaves celebrex renova tramadol cialis peeling a girl fact if identical from else they located pharmacy feel Vine in viagra blue genuine cut buying where there mercurous OUT labelling for performance! Do discounted viagra palettes good – !.

transactions linked to the breach have begun to increase significantly—suggesting that the card numbers are just now beginning to be sold to cashers.

According to a card fraud expert quoted by BankInfoSecurity, forensic details that are surfacing about the breach suggest that the chain’s corporate network was attacked by three different strains of malware, two of which were completely new and all of which were built to withstand reverse engineering. The malware appeared to be similar to that used in the attack against Schnuck Markets that started last December and ran for four months.

The fact that the malware was in the corporate networks, not just in store POS systems, suggests the number of cards affected could be everything that ran through the systems during the breach period, as well as any other card numbers stored on the networks. And though advisories from Visa and MasterCard put the breach period between June 14 and July 20, some issuers have said they believe the breach could have started earlier.

Which means, in practice, that card brands and issuers are all guessing. They believe they know when the breach was stopped, presuming that all the malware was actually found. And they think they know when it started. How many cards’ details were actually stolen? Harbor Freight isn’t making any estimates, and that’s probably wise.

What’s especially troubling about the Harbor Freight breach is that the guessing is necessary. Like the Schnuck’s and Mapcobreaches, this looks like thieves essentially planted themselves in the middle of the corporate transaction stream and collected card numbers.

That shouldn’t be possible for retailers this size. The point of PCI is to keep chains on their toes, not guarantee that chains have perfect security. But once you get into the $2 billion range like Harbor Freight, PCI really is just a prod. Of course retailers that big are monitoring security constantly.

But still the thieves got in. In the case of Schnuck’s, they got in less than a month after a successful PCI compliance validation. In Harbor Freight’s case, being PCI-compliant apparently didn’t hamper the thieves either. And security scans of Harbor Freight’s systems weren’t what spotted the breach—it was the usual fraudulent transactions nexus analysis by card companies.

Let’s leave aside the question of whether PCI is truly useless. There’s nothing a PCI audit is looking for that doesn’t represent current best practices, so PCI is at least a baseline.

But what if those “best practices” simply aren’t good enough? What if everybody is getting it wrong?

It’s increasingly looking like that’s the case. When two flavors of never-before-seen malware show up in a single breach, it suggests thieves are getting more aggressive. They’re throwing more resources at each breach because they’re seeing results. What’s worse, from the retailers’ point of view, they’re understanding those best practices—and the better thieves understand them, the better they understand the standard weaknesses in corporate payment transaction systems.

Which means increasingly it’s the chains that are guessing, and the thieves that aren’t.

It also means that we may finally have come to the end of the line for any stored card data by retailers, encrypted or not. If best practices can’t keep thieves out of the payment-card transaction stream on corporate networks, the only safe thing is to move those transaction streams out of corporate networks.

Of course, that means the next big target for cyberthieves will be card processors. But if you’re a retailer, better them than you.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.