Evan Schuman's StorefrontBacktalk

What looked initially like a two-store payment-card breach may end up being one of the biggest breaches of 2013. In late July, the 425-store discount hardware chain Harbor Freight Tools posted signs in its stores, warning customers that there might have been a problem with some in-store card transactions. Now it appears thieves were using multiple kinds of malware to tap transactions between June 14 and July 20, and the breach has affected at least 30,000 card holders at just two card issuers. That’s eventually expected to climb into the millions.

Harbor Freight itself isn’t saying much except that it hired Mandiant to investigate and that the malware has been found and blocked. But card issuers and card brands are now sending out advisories about possibly compromised card numbers on nearly a daily basis, according to BankInfoSecurity, which has been tracking the breach. And it’s only in the past two weeks that fraudulent

transactions linked to the breach have begun to increase significantly—suggesting that the card numbers are just now beginning to be sold to cashers.

According to a card fraud expert quoted by BankInfoSecurity, forensic details that are surfacing about the breach suggest that the chain’s corporate network was attacked by three different strains of malware, two of which were completely new and all of which were built to withstand reverse engineering. The malware appeared to be similar to that used in the attack against Schnuck Markets that started last December and ran for four months.

The fact that the malware was in the corporate networks, not just in store POS systems, suggests the number of cards affected could be everything that ran through the systems during the breach period, as well as any other card numbers stored on the networks. And though advisories from Visa and MasterCard put the breach period between June 14 and July 20, some issuers have said they believe the breach could have started earlier.

Which means, in practice, that card brands and issuers are all guessing. They believe they know when the breach was stopped, presuming that all the malware was actually found. And they think they know when it started. How many cards’ details were actually stolen? Harbor Freight isn’t making any estimates, and that’s probably wise.

What’s especially troubling about the Harbor Freight breach is that the guessing is necessary. Like the Schnuck’s and Mapcobreaches, this looks like thieves essentially planted themselves in the middle of the corporate transaction stream and collected card numbers.

That shouldn’t be possible for retailers this size. The point of PCI is to keep chains on their toes, not guarantee that chains have perfect security. But once you get into the $2 billion range like Harbor Freight, PCI really is just a prod. Of course retailers that big are monitoring security constantly.

But still the thieves got in. In the case of Schnuck’s, they got in less than a month after a successful PCI compliance validation. In Harbor Freight’s case, being PCI-compliant apparently didn’t hamper the thieves either. And security scans of Harbor Freight’s systems weren’t what spotted the breach—it was the usual fraudulent transactions nexus analysis by card companies.

Let’s leave aside the question of whether PCI is truly useless. There’s nothing a PCI audit is looking for that doesn’t represent current best practices, so PCI is at least a baseline.

But what if those “best practices” simply aren’t good enough? What if everybody is getting it wrong?

It’s increasingly looking like that’s the case. When two flavors of never-before-seen malware show up in a single breach, it suggests thieves are getting more aggressive. They’re throwing more resources at each breach because they’re seeing results. What’s worse, from the retailers’ point of view, they’re understanding those best practices—and the better thieves understand them, the better they understand the standard weaknesses in corporate payment transaction systems.

Which means increasingly it’s the chains that are guessing, and the thieves that aren’t.

It also means that we may finally have come to the end of the line for any stored card data by retailers, encrypted or not. If best practices can’t keep thieves out of the payment-card transaction stream on corporate networks, the only safe thing is to move those transaction streams out of corporate networks.

Of course, that means the next big target for cyberthieves will be card processors. But if you’re a retailer, better them than you.