Ten months into 2024, the year is on track to set the dubious record as having the largest number of records stolen - the worst data breaches of 2024 have surpassed 1 billion stolen records, and that number continues to rise.

One of the worst hit was AT&T – where two data breaches affected nearly all their customers. How? Well, perhaps the most concerning thing in their case is that they reportedly still do not know how the breaches happened.

At Change Healthcare, medical data from what is estimated to be over 100 million people was stolen. How? Because their critical systems were not protected with multi-factor authentication.

Snowflake, a leading cloud data platform, was hit with a series of data thefts that quickly became one of the biggest breaches of the year. Customer data was stolen from such big-name companies as Ticketmaster and Advance Auto Parts. How? Hackers were able to use credentials stolen from data engineers with access to Snowflake’s environment, because they do not automatically enroll or require its customers to use multi-factor authentication.

While it is true that much of the lost data was not payment card data, simply complying with PCI requirements to require multi-factor authentication may have prevented all these breaches.

Slim CD, a payment gateway provider based in Coral Springs, Florida recently notified 1,693,000 cardholders that they have been breached.

The data compromised included full names, addresses, credit card numbers, and credit card expiration dates. At the time of the notification, the company stated that there is “no evidence that any such information has been used to commit identity theft or fraud.”

Slim CD first noticed suspicious activity in mid June. An investigation by a third-party specialist revealed that hackers had access to Slim CD’s systems for 10 months, between August 17, 2023, and June 15, 2024. Despite having access for nearly a year, the company says that hackers only had access to credit card information between June 14 and June 15, 2024.

They have not yet announced what caused this breach, but had audit logs been checked daily, as required in Section 10 of the SAQ, this should have been caught almost immediately – long before 10 months when the data was stolen.

Two banks recently joined the ranks of companies who have been breached. According to the Office of the Maine Attorney General, Wyoming-based Summit National Bank and Canadian based TD Bank both suffered data breaches.

Summit National Bank notified 10,912 customers that their personal information, including both Social Security numbers, and financial account information, has been accessed by an unauthorized party. The suspicious activity was first discovered in May of 2024. The bank has now determined that the breach occurred between May 13th and 16th. The details of how the information was stolen have still not been released.

In a separate filing, TD Bank reported in July of 2024 that 41 of their customer’s accounts had personal information leaked that included names, addresses, social security numbers, dates of birth, debit card numbers, expiration dates, and security codes. A bank employee improperly accessed the effected accounts between September 2023 and March 2024 without a legitimate business purpose.

Merchants often say that they have no PCI compliance requirement because their processor, or a third party, manages it. At the end of the day, no matter how a merchant processes, if they have cardholder data, there will always be a risk of employee theft.

The MAXpci Team Wishes Everyone a Safe, Relaxing, and Fun Labor Day Weekend!

With so much focus on online fraud, third-party breaches, and ransomware attacks, we tend to forget that fraud can happen at any merchant, any time. ALDI, the grocery store chain, recently announced that they were the victim of an attack. ALDI has confirmed that skimmers were discovered in self-checkout terminals in five of their locations, two in New Jersey, three in California, at the end of 2023. The skimmers were able to steal the payment card information of any customers that made purchases during the time that the skimmers went unnoticed. This information included cardholder names, card numbers, card expiration dates, PIN, and security codes.

While they did fail to maintain PCI compliance when they allowed unauthorized individuals to access their terminals, they did catch it very quickly, which undoubtedly reduced the impact of this breach.

Ticketmaster, the event ticket sales, and distribution company based in California, suffered a data breach on May 20th, 2024. Their parent company, Live Nation, released a statement acknowledging that they identified “"unauthorized activity within a third-party cloud database environment containing Company data". The information was stolen from their third-party account at Snowflake. LiveNation released the following statement regarding the breach,

"As appropriate, we are also notifying regulatory authorities and users with respect to unauthorized access to personal information.”

They also included the statement below regarding steps they were taking to increase security in an email sent to customers that may have been impacted by the breach,

"These measures include rotating passwords for all accounts associated with the affected cloud database, reviewing access permissions, and increased alerting mechanisms deployed in the environment,"

The hacking group known as ShinyHunters have claimed they are responsible for the breach and that they stole the personal information of 560 million of Ticketmaster’s customers. The hacking group has listed the 1.3 terabytes worth of user data on the dark web for $500,000. This data includes customer’s names, addresses, phone numbers, and credit card information. The Justice Department shows that the ShinyHunters have been around since early 2020 and are responsible for the breach of over 60 American companies.

"The victims range from tech companies to an international stock trading company, to an apparel company, and a nutrition and fitness company," the department said in January 2023. "Millions of customer records were included in the stolen data."

Once again, this breach may have been prevented had they required multi-factor authentication, strong passwords, and password rotations, as required by Section 8 of the PCI DSS 4.0.

Earlier this month, the city of Wichita, Kansas fell victim to a ransomware attack causing the city to shutdown their network to prevent malware from spreading further into the network. This network shutdown affected several of the city’s payment systems causing the city to offer free bus rides and pausing water shut off for non-payment. The Ransonware gang LockBit claimed responsibility for the breach and said the information has been sold on the black market.

In a statement released by the city, it was revealed that the files copied included traffic incidents and other information which contained sensitive data.

“As part of our thorough review and assessment of this matter, we identified that certain files were copied from our computer network without permission between May 3 and 4, 2024. These files contained law enforcement incident and traffic information, which include names, Social Security numbers, driver’s license or state identification card numbers, and payment card information.”

The city has not yet disclosed details regarding the vulnerability that was exploited. As of now, they have said only that “We identified that this matter is related to a recently disclosed security vulnerability that affects organizations throughout the world.”

Requirement 6 of the newest version of PCI DSS requires that businesses protect themselves from vulnerabilities being exploited by thieves by applying security patches as soon as possible. Complying with that may have helped to protect against this attack.

Last month we wrote about the credential stuffing attack that streaming service Roku suffered that compromised a little over 15,000 customer accounts – a small breach by any measure. Fast forward to April 12th when Roku announced that they had suffered another credential stuffing breach, this time effecting 576,000 additional user accounts, and it is no longer so small.

While the hackers still did not gain access to credit card numbers, they were able to purchase streaming subscriptions and Roku hardware using the stored card data of four hundred customers.

Roku continues to maintain that their system was not breached. They believe that the credential information was obtained in a breach where the account holders used the same login credentials, and hackers are using them to gain access wherever they can. To help secure all eighty million subscriber accounts, Roku is implementing two-factor authentication (2FA), a form of multi-factor authentication (MFA). The next time subscribers attempt to log in, an email will be sent to the email address on file and the user will be required to click a link before they will be able to log into their accounts.

To further help secure accounts, Roku has also posted an article on their customer support page that provides information on how their customers can keep their Roku account secure. The article recommends using a strong password that includes upper-case and lower-case alpha characters, numeric and special characters, that customers not use the same password across multiple accounts, and to be aware of any suspicious communications that claim to be from Roku – also known as a phishing. It is interesting to note that the recommendations Roku has chosen to share with their own customers are also now requirements that Roku must have in place in order to be PCI compliant under version 4.

Streaming company, Roku recently disclosed that they had suffered a breach that compromised 15,363 accounts. Fortunately, the breach did not provide thieves with credit card information; however, if credit card information was on file in the accounts, the thieves were able to purchase subscription services, such as Netflix, Paramount Plus, Hulu, and many other streaming subscriptions offered thru Roku.

According to Roku, the credentials were most likely stolen in a data breach of a third-party service. When credentials are stolen during a breach, hackers use those credentials on other sites, a practice known as credential stuffing. In this case, once the hackers were able to access an account on Roku, they changed the password and took over the account. On top of buying streaming services, the login credentials for accounts that contained credit card information were also sold for about $.50 cents an account, along with information on how to use the information to make other fraudulent purchases.

Credential stuffing attacks can be neutralized by requiring that multi-factor authentication, (MFA), is in place, one of the newer requirements in PCI DSS version 4, which becomes mandatory this weekend. With MFA in place, passwords alone will not allow access to an account, rendering the data useless.

Joshua Rogers, an Australian security researcher, recently released what he intended to be a tool called SSH-Snake.  SSH-Snake was created to find SSH keys on systems, create a map of a network and its dependencies, the relationships between systems connected via SSH, and to which extent the network can be compromised using SSH keys. The idea behind it is to help system administrators to better understand and secure their network.  However, as Rogers pointed out, it’s actually a form of malware.

 “It’s completely self-replicating and self-propagating — and completely fileless. In many ways, SSH-Snake is actually a worm: It replicates itself and spreads itself from one system to another as far as it can,”

Not long after its release, hackers started using it to perform malicious attacks on the networks, attacking at least 100 corporations so far. According to researchers at Sysdig, a cloud security company, the open-sourced network mapping tool has already been repurposed by criminals to perform malicious attacks on networks.  Sysdig researcher Miguel Hernandez had several thoughts on this new malware.

"SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network. The worm automatically searches through known credential locations and shell history files to determine its next move. The usage of SSH keys is a recommended practice that SSH-Snake tries to take advantage of in order to spread," Hernández said. "It is smarter and more reliable which will allow threat actors to reach farther into a network once they gain a foothold."

One particular modification ability this worm has is to make itself smaller when running for the first time. This is done by removing comments, unnecessary functions, and whitespace from its code.  Once it’s in a network, the SSH-Snake uses various methods to locate private keys.  Some examples are shown below.

• Searching through common directories and files where SSH keys and credentials are typically stored, including .ssh directories, config files, and other locations.

• Examining shell history files (e.g., .bash_history, .zsh_history) to find commands (ssh, scp, and rsync) that may have used or referenced SSH private keys.

• Using the ‘find_from_bash_history’ feature to parse the bash history for commands related to SSH, SCP, and Rsync operations, which can uncover direct references to private keys, their locations, and associated credentials.

• Examining system logs and network cache (ARP tables) to identify potential targets and gather information that might indirectly lead to discovering private keys and where they can be used.

“Threat actors will always have tools to accomplish their goals even if none are published openly. The open publication of tools like SSH-Snake might save threat actors some time, but leveraging these tools makes them more detectable,” Hernandez told SC Media. “Also, by making these tools public, defenders have the opportunity to learn how they work and see how their defenses hold up.”

Rogers also points out that SSH-Snake itself helps organizations prevent malicious SSH-Snake infection.

"For any infrastructure owners or maintainers worried about their systems being taken over by SSH-Snake, I implore them to utilize SSH-Snake themselves in their own infrastructure to discover the attack paths that exist - and fix them."

Orrick, Herrington & Sutcliffe, an international law firm based in San Francisco that assists companies that suffer security incidents, recently updated the number of individuals affected by a breach of their own network that occurred in February and March of 2023. They first announced that they had been breached in July of 2023, saying that they had discovered unauthorized access to part of its network that housed information from victims of breaches suffered by their clients. The information accessed included names, addresses, dates of birth, Social Security numbers, driver’s license or other government ID numbers, passport numbers, email addresses, financial account details, tax identification numbers, medical and health information, health insurance and healthcare provider details, online account credentials, and credit or debit card numbers. Initially the company disclosed that 152,818 individuals were affected, in August that number rose to 461,100, now that number is over 637,000. This breach affects not only Orrick, Herrington & Sutcliffe clients, including Delta Dental of CA, EyeMed Vision Care, and the U.S. Small Business Administration, but also their clients’ clients, which means the number of victims could continue to grow.

Colin Little, security engineer at Centripetal stated,

“This is a cyber-attack and data breach in a different class: a theft of sensitive operational information detailing how enterprise defenders, law enforcement, and incident responders handle theft of sensitive information.”  He also went on to say, “I imagine many techniques, tactics and procedures were just handed to the criminals, including tools used by LE and IR to forensically investigate cyber-attacks, attribute cyber-attacks to persons or groups, details about a breached institution’s response plans and effectiveness in executing those plans, the tools that told them they were being attacked, and how it told them.” “The damage from this breach could have a negative impact on future data breach investigations, mass exploitation events, and the success of law enforcement investigations concerning cybercrime.”

Orrick has largely refused to disclose details about what led to the breach, though they did release a statement to Information Security Media Group that said, “On March 13, we identified a threat actor targeting our file storage devices where we maintain certain client files."

The firm's investigation determined that an unauthorized actor accessed client files containing protected health information and personally identifiable information between Feb. 28 and March 7.

"We did not experience any client service or operational disruptions, nor did we identify any ransomware related to this attack. We reported the matter to law enforcement," Orrick said.

Delta Dental of California has been added to the growing list of victims of the MOVEit breach. Delta notified nearly 7 million patients that they suffered a breach on December 14, 2023, exposing names with the combination of the following information: addresses, Social Security numbers, driver’s license numbers or other state identification numbers, passport numbers, financial account information, tax identification numbers, individual health insurance policy numbers, and/or health information.

According to Emisoft, an estimated 2,667 organizations have been affected by this breach, which in turn has affected almost 84 million people. Teresa Rothaar, governance, risk, and compliance analyst at Keeper Security said, “News that the zero-day vulnerability is still being exploited should serve as a wakeup call to every organization to remediate the MOVEit issue immediately. All organizations should take a proactive approach to regularly updating software and immediately patching vulnerabilities that are being actively exploited in the wild.” She also went on to say,

“Organizations must ensure they have a patch deployment process defined and written down, with emergency levers for critical vulnerabilities.” “While not every attack can be prevented, teams can take steps to mitigate the access of cybercriminals and minimize impacts on systems, data, and operations. The most effective method for minimizing sprawl if an attack does occur is by investing in prevention with a zero-trust and zero-knowledge cybersecurity architecture that will limit, if not altogether prevent, a bad actor’s access."

The CEO at Viakoo, Bud Broomhead, added “that it was known that the MOVEit vulnerability would have a long-term impact when it was announced in June. It’s likely we will continue to see announcements like this as organizations come to terms with whether their data was exfiltrated and to what extent customer data was included.”

“Because of the scale that MOVEit operates at, one might suspect this and previous breaches reported are truly the tip of the iceberg,” said Broomhead. “Kudos to Delta Dental of California for having the forensics in place to make these determinations, but not all organizations will be capable of doing that. What’s surprising is the ‘depth’ of data that was included: why would my dental insurance company need to retain passport numbers or other detailed personal information? Organizations should reconsider what data truly needs to be retained within personal records and reduce it to a minimum.”

To meet PCI requirements in section 6.2, critical security patches must be installed within 30 days of release. These patches are created to secure any vulnerability that is found to prevent bad actors from taking advantage of them.

The Team at MAXpci wishes everyone a Happy and Healthy Holiday, and a Wonderful New Year!

When most people think of card skimmers, they automatically think of credit and debit card information being stolen; however, there is another group of cards that are susceptible to having information compromised - SNAP EBT cards. SNAP EBT cards are issued to people receiving benefits from the Supplemental Nutrition Assistance Program. The cards are a fast and convenient way for funds to be loaded and re-loaded each month.

Since SNAP EBT cards use a PIN like traditional debit cards, they offer some security against loss – but is it enough? In recent months, multiple U.S. authorities in several states have reported an increase in SNAP EBT fraud. Thieves are using card skimmers installed on terminals to steal card information, then they create clone cards to access SNAP participants’ benefits. Since most of these cards are not EMV, they are much more susceptible to having their information stolen. Because the cards are neither debit nor credit cards, which offer protection for the cardholder, victims of this type of fraud typically do not get reimbursed for their loss.

There are two options that would help to curb this type of theft.  The first option would be for the SNAP program in each state to begin issuing EBT cards that have the smart chip installed. Countries that have implemented EMV card programs have seen a decrease in card information being stolen. The second option would be for businesses to make sure they are following the PCI DSS standards to decrease the chances of skimmers being installed at their business. Requirement 9 of PCI DSS 3.2.1 addresses the standards merchants must follow to protect their machines.

While many companies are not looking forward to the new requirements for PCI DSS 4.0, new statics show why investing the time and money into meeting the new requirements may be worth it. According to Cost of a Data Breach Report by Ponemon Institute, there are nearly 68 records compromised every second with a median cost of $150 per record. The global average cost for 2022 reached $4.35 million dollars an increase of 2.6% from 2021. The report also shows that the United States represents most of the attacks - 57% of the companies breached are in the US.  Many people assume that thieves prefer large businesses, but reports show that attacks on small business make up 43% of breaches. The loss a company feels after a breach is not always due to money they must pay out, 65% of companies that were breached said their business also suffered losses due to their reputation being marred.

One “tool” criminals use to compromise websites is formjacking, with almost 8000 websites being compromised per quarter. Formjacking refers to using JavaScript codes to take over payment forms on websites. Defending against this issue is one of the key focuses of version 4.0.  For many years, PCI standards have focused on back-end server security and this update moves the focus more to client-side vulnerabilities. PCI DSS v4.0 requirements related to browser security requires an automated technical solution for public-facing web applications that continually detects and prevents web-based attacks (PCI DSS 4.0 Section 6.4.2); requires management of all payment page scripts that are loaded and executed in the consumer’s browser (PCI DSS 4.0 Section 6.4.3), and to deploy a change-and-tamper detection mechanism to alert for unauthorized modifications to the HTTP headers and contents of payment pages as received by the consumer browser (PCI DSS Section 11.6.1).

With E-Commerce sales expected to reach over $5 Trillion dollars by the end of 2022, it’s not surprising that thieves take advantage of websites that they find are vulnerable to this type of attack.

The Dark Web has always been the go-to place to buy stolen credit card data. Stolen credit card information is a big-ticket item, especially if the expiration date and CVV code are included with credit card number.  To crack down on fraud, nearly all card vendors have switched to issuing EMV chip cards. Cybersixgill, a cyber intelligence provider, recently reviewed credit card information available on the Dark Web for their “Underground Financial Fraud H1 2022 Report”, and it appears that EMV is helping.

According to their report, more than 4.5 million stolen payment cards were up for sale on the Dark Web during the first half of 2022. While this is by no means a small number, it is a 68% drop from the more than 14 million cards found during the last half of 2021. Clearly the transition to EMV chip cards has had an impact, but there is still a substantial amount of card information available on the Dark Web. Roughly 45% of card information found underground were from cards issued in the United States. Experian believes that this is due to the U.S. being home to more than 1 billion credit cards. Cybersixgill believes that the large number of U.S. issued cards is due to European countries implementing EMV earlier than the U.S. did. Most stolen credit cards available are from the four major card brands:

Visa                                    49%
Mastercard                         36%
American Express              13%
Discover                               2%

“Despite continued efforts by law enforcement agencies, credit card networks, banks, and retailers to improve security, fraudsters are expected to adapt and evolve their skills and techniques, finding new methods to exfiltrate sensitive payment credentials from cards being utilized both virtually and physically,” Cybersixgill said in its report.

With the release of version 4.0, the PCI Security Council views security as a continuous process. Enhanced validation procedures allow merchants and developers to put new solutions that defend against existing and emerging threats in place much more quickly than in the past, which should reduce the number of cards stolen even further.

According to DataBreaches.net, Marriott has been the victim of yet another data breach. Hackers claim to have stolen 20 gigabytes of sensitive data, including credit card data, from the BWI Airport Marriott in Baltimore, MD.

Melissa Froehlich Flood, a spokesperson for the Marriott, told The Verge that the company was “aware of a threat actor who used social engineering to trick one associate at a single Marriott hotel into providing access to the associate’s computer.” Before going public with the hack, the threat actor had tried to extort the hotel chain, but no money was paid, Froehlich Flood said.

This is not the first time Marriott’s cybersecurity has been breached. DataBreaches.net has been tracking security breaches at Marriott or Marriott-owned hotels since 2010.

September 2010 – HEI Hotels & Resorts had a “vulnerability in an information system at certain of its hotel properties exploited”.

April 2011 – The Marriott Reward Program was breached due to a breach of their vendor Epsilon.

November 2018 – Marriott learned that a hotel they acquired in 2016 had been breached in 2014. This breach was estimated to have impacted 383 million guests.

October 2019 - While still dealing with litigation from the 2018 breach, another of Marriott’s vendors was breached.

March 2020 – Marriot announced a breach that took place in January and February 2020 which exposed 5.2 million guests’ personal information. This breach was caused by compromised login credentials for two of their employees.

Though the most recent breach is not the worst they have faced, it does demonstrate that thieves will repeatedly attack the same target.

Jack Chapman, VP of threat intelligence at cloud security provider Egress said, “As this latest data breach demonstrates, organizations that are victims of previous attacks are more likely to be targeted in the future. Social engineering is a highly effective tool and cybercriminals know that an organization’s people are its biggest vulnerability – which is why they return to this technique again and again.”

This is why it is important to make sure passwords are frequently reset, compromised credentials are changed, and employees are trained in email phishing techniques. Incidents like this also help to explain why the PCI Security Council has put strong emphasis on multi-factor authentication, (MFA). PCI DSS v4 requires all users with access to cardholder data to use MFA, not just administrators.

Assessing and strengthening password and authentication policies is one significant change in PCI DSS v4.  Not only are requirements more stringent, they also address securing remote access, a path used by many hackers to infiltrate systems in the past.

Once v4 becomes the Standard, merchants must:

1. Require multifactor authentication for all users accessing cardholder data.  In versions past, multifactor authentication was required only for administrators who access systems related to processing or cardholder data. The newer version will require multifactor authentication for any account that has access to cardholder data.
2. Change user’s passwords at least every 12 months, and any time that a compromise is suspected.
3. Require that passwords be at least 15 characters in length and include both numeric and alphanumeric characters.  Prospective passwords will also need to be compared against a list of passwords that are known to be compromised.
4. Review access privileges every six months to confirm that only people who specifically need access to cardholder data have permission.
5. Enable vendor or third-party accounts only as needed and monitor them regularly while in use.

Merchants will not be required to comply with these changes until March 31, 2024, when v4 becomes the only Standard, but there’s no reason not to put these in place now. Each one of these requirements increases security to help prevent a compromise.

The MAXpci Team wishes everyone a Happy & Safe 4^th of July!

The 2022 Verizon Data Breach Investigation Report shows that for the fifth consecutive year ransomware continues its upward trend with nearly 25% of all data breaches involving ransomware.  This trend indicates that despite warnings to businesses, ransomware continues to be a major cause of data breaches. The report shows the use of ransomware increased nearly 13%, a figure higher than the last 5 years combined.  What makes ransomware so attractive to cybercriminals is the fact that they don’t have to find specific data; they are able to cripple the organization’s daily operations by simply encrypting all of their data.  Alex Pinto, team manager at Verizon DBIR made the following statement regarding ransomware.

"You're just selling back to the people who you stole from in the first place," he said. "They are the perfect customer for you, and this is what makes it so appealing as a vector of growth in the way that financially motivated breaches play out in the threat landscape." "Especially those in these specific small companies, which are less than 10 employees, they have been severely hit by ransomware,"

The report also shows that nearly 80% of attacks against very small businesses (ten employees or less) are ransomware attacks. These small businesses are easier targets because they don’t tend to have large amounts of money to invest in their cybersecurity.

Desktop sharing software is used to access data in 40% of the attacks, while 35% involved malicious links or attachments in emails.  It is vital that businesses of all sizes take steps to secure their data.  Those steps can be as simple as utilizing antivirus programs to remove bots, and ensuring that security patches are installed immediately.  The use of two-factor authentication and password managers provide significant help in safeguarding credentials.  Email training for employees is also vital to prevent breaches.  This training helps to teach employees to be suspicious of attachments or links and spot the growing number of phishing attempts. By combining these tools, even the smallest businesses reduce their exposure to ransomware.

The MAXpci teams wishes you a warm and safe Memorial Day.

Let us remember all of our heroes who have left us

while saving our lives and our country.

With the release of PCI DSS v4.0, the Security Council has responded to ever-changing technology by providing increased flexibility to merchants to help them secure cardholder data on an ongoing basis.

Emma Sutcliffe, the SVP, Standards Officer of the PCI SSC, says that:

            “PCI DSS v4.0 is more responsive to the dynamic nature of payments and the threat environment. Version 4.0 continues to reinforce core security principles while providing more flexibility to better enable diverse technology implementations. These updates are supported by additional guidance to help organizations secure account data now and into the future.”

Four main objectives the new version meets are:

•           Updated firewall terminology to network security controls to support a broader range of technologies used to meet the security objectives traditionally met by firewalls

•           Expansion of Requirement 8 to implement multi-factor authentication (MFA) for all access into the cardholder data environment

•           Increased flexibility for organizations to demonstrate how they are using different methods to achieve security objectives

•           Addition of targeted risk analyses to allow entities the flexibility to define how frequently they perform certain activities, as best suited for their business needs and risk exposure

Chetan Anand, the Associate Vice President of Information Security and CISO at Profinch Solutions, explains that continuous compliance starts with setting a solid foundation.

"First and foremost, one must develop and maintain a sustainable security program. This requires understanding that the purpose of the PCI DSS is to protect cardholder data from damages resulting from the theft or improper disclosure of cardholder data," he says. "This includes everyone in the payment chain: merchants, service providers, acquirers, issuers, the payment brands, and consumers."

Most current security methods secure the card data in its “container” - servers, networks, applications, etc., but this doesn’t allow for security once the data is in motion. According to the PCI Counsel “the main goal of 4.0 is to promote security as a continuous process.”

The big day is finally here – the Security Council is releasing the long-awaited PCI DSS v4.0 Standards.  The documentation will be rolled out over the next few months, beginning with the Summary of Changes document now, along with the Report on Compliance Template and Attestations of Compliance.  The SAQs will follow in the coming weeks. 

Once the SAQs are released, they’ll be translated into several languages. The translated versions will be released between now and June 2022.

New Standards mean new training for QSAs and ISAs.  Training is scheduled for June of 2022. We expect additional supporting documents to be published by the end of June.
 

The transition period from PCI DSS v3.2.1 to v4.0 is significantly longer than we’ve seen in the past.  While v4.0 is being released now, both versions will be available for a full two years, allowing merchants time to become familiar with the new Standards, and make any required adjustments. PCI v4.0 will be the only active version on March 31, 2024.

The threat of ransomware attacks has become so significant that the National Cybersecurity Alliance and the PCI Security Standards Council issued a joint warning bulletin earlier this month. In 2021, ransomware was responsible for attacks at 37% of businesses globally, with an estimated cost of $20 billion.

In a blog post on the subject, Lance Johnson, executive director of the PCI Security Standards Council, said:

“These cyber threats are real and require immediate action to better protect against these ongoing criminal activities.”

There is nothing new about ransomware, it’s been around for years. What is new is the increased number of attacks. In 2021, ransomware attacks represented 21% of reported data breaches, up from 17% in 2020. Thieves normally use phishing attacks to gain access to consumer data, such as usernames, passwords, and account numbers, but they are also becoming more sophisticated, allowing them to gain access to companies’ networks for bigger attacks. Once the malware is in the network, it can take advantage of any website or software vulnerabilities.

Prevention is by far the best defense against ransomware. Best practices to prevent a ransomware attack include:

• Identifying and securing important and valuable data

• Making sure all software applications are up to date by installing patches from vendors as they become available

• Monitoring the network for suspicious or unauthorized changes and investigating any such changes

• Regularly backing up data and testing the data recovery

• Educating employees about how to spot potential threats and how to avoid them

“The surge in ransomware activity has left many businesses and governments around the world scrambling for answers as they struggle to stay a step ahead of organized cybercriminal gangs,” Johnson says. “Utilizing good payment security practices and protocols can go a long way in guarding against these attacks.”

PulseTV, the “As Seen on TV” retailer announced that they have been the victim of a breach. The breach started in November of 2019 and continued undetected until August of 2021. The breach was not discovered until November of 2021, by which time over 200,000 credit card records may have been exposed.

In a notification letter sent by PulseTV to its customers, they stated that Visa contacted them on March 8, 2021, and said that they were a common point of purchase for fraudulent credit card use, and that their e-commerce website may have been breached. PulseTV checked their network for malware and reviewed their security settings. They found no evidence to indicate that their site had been breached.

A few months after Visa contacted them, they were contacted by a law enforcement agency that was investigating fraudulent transactions that appeared to have come from pulsetv.com. According to the notification sent to customers, at that point PulseTV “started working with legal counsel with an expertise in cybersecurity. Legal counsel also hired nationally-recognized cybersecurity experts to assist with the investigation.”

The letter goes on to state “On November 18, 2021, our investigator learned that the website had been identified as a common point of purchase for a number of unauthorized credit card transactions for MasterCard. Based upon communications with the card brands, it is believed that only customers who purchased products on the website with a credit card between November 1, 2019 and August 31, 2021 may have been affected. The investigation was unable to verify that the website was the cause of the unauthorized transactions. However, in an abundance of caution, PulseTV is notifying customers, including you, who purchased products on our website during that time period so that they can take steps to protect and secure their credit card information.”

The Daily Swig reports that “The symptoms of the incident match those of earlier Magecart-style attacks that involve planting JavaScript skimmers within the checkout process of online stores.”

A Magecart attack is a cyberattack that injects malicious code into ecommerce checkout pages. This allows the hacker to “skim” sensitive and payment card data. Detecting this type of attack early is essential to preventing or minimizing the loss of card data. The use of file-integrity monitoring or change-detection software and regular internal and external network scans are crucial to early detection, as is requiring strong authentication for all access to system components, and things as simple as anti-virus protection and regularly applying security patches. This breach went undetected for nearly two years, despite notifications from Visa, law enforcement, and Mastercard, which led to a significant number of records being compromised.

As we know, the pandemic created new security issues for merchants. Unfortunately, many have yet to fully address these issues, and they remain vulnerable to attack. Hackers know it, and have been taking full advantage of this, particularly in the case of mid-sized companies.

Security provider Coro recently published a report, "The Great Cyber Security Market Failure and the Tragic Implications for Mid-Sized Companies," that analyzed information from over 4,000 mid-sized companies, (defined in the study as companies with between 100 and 1,500 employees).  According to the report, the mid-sized businesses examined saw the number of attacks increase by at least 50% between 2020 and 2021. Businesses in the healthcare and transportation industries were hit hardest, with an increase of more than 125% during the twelve months from October 2020 to October 2021. The number of attacks at retail, manufacturing and professional services companies increased between 86% and 90% during the same timeframe.

The report goes on to say that mid-sized companies are 490% more likely to be the victim of a breach or other security incident today than they were in 2019. At the start of the pandemic, businesses shifted to remote work environments, which significantly increased the number of devices connecting to their networks remotely. They also increased their use of the cloud. Cybercriminals have responded with ransomware attacks via the cloud and email, endpoint malware, Wi-Fi phishing and insider threats to exploit any vulnerabilities, all of which many of these mid-sized businesses are woefully unprepared to ward off nearly two years later.

To help midsize businesses better protect themselves from data breaches and cyberattcks, Coro CEO Guy Moskowitz provides the following advice:

1. Make sure you secure your email and cloud applications against malware, ransomware and account takeover. Such protection is not typically covered by email or cloud service providers.
2. Antivirus products offer only a small chunk of the protection you need. Look beyond standard antivirus solutions toward full-fledged ransomware protection and device security tools.
3. Install phishing prevention and protection for your email, Wi-Fi connectivity, and cloud applications.
4. If you store private information for customers or employees, be sure to set up insider threat detection and data loss prevention across your endpoints, cloud applications, cloud storage and email.

As 2021 comes to a close, we wish you

a Happy New Year filled with

 good health, happiness, and success!

Over the last year and a half, many companies have shifted their cybersecurity attention to securing remote workers and Ecommerce sales. A recent breach notification from Costco is a reminder that breaches at brick-and-mortar locations are still a threat. On November 5^th, 2021, Costco notified members that their payment card information may have been compromised because a skimming device was discovered on a payment terminal. Costco warned customers that the skimmer may have “acquired the magnetic stripe of your payment card, including your name, card number, card expiration date, and CVV.” A Security Awareness Advocate from KnowBe4, Erich Kron, believes that PIN numbers may have also been accessed during the breach.

“Because Costco does not accept all major credit cards, many members have to process the payment as a debit card, allowing the cybercriminals that attached the skimmer to not only get the card number but also the PIN number,” Kron said.

Costco hasn’t announced the number of customer’s affected, nor have they revealed the location of the breach, but Chris Clements, Vice President of Solutions Architecture at Cerberus Sentinel believes a significant number of customers may have been affected if the skimmer was placed on a terminal in a high traffic area.

“If undetected for even a month, it can compromise thousands of credit cards,” Clements said. “Costco didn’t say how routine the point-of-sale terminal checks that detected the skimmer occur, but with the scale of damage that can result from even one skimmer, retail organizations need to make it a frequent procedure.”

Armen Najarian, Chief Identity Officer at Outseer, believes that retailers will see an increase of these types of breaches this holiday season.

“As we head into the holiday season, hackers and other bad actors will target retailers made vulnerable by short staffing and high transaction volumes.”

“All of this, unfortunately, will be amplified this year as pandemic-induced labor shortages reach unprecedented levels. If retailers want to keep their customers safe and happy this holiday season, they need to prioritize payment authentication software for in-store and online transactions alike.”

This case is a good reminder that despite changes to the payments space over the last year and a half, thieves continue to use “old school” methods to access payment card information.

As we head into December, the team at MAXpci sends you and yours our best wishes for a safe, healthy, and happy holiday!

Security is an ongoing concern for businesses forced to send their employees home to work from hastily set up home offices. Once expected to be a short-term solution, work from home solutions have become permanent for many companies. In recognition of National Cyber Security Awareness Month (NCSAM), the PCI Security Standards Council is sharing resources each week on their PCI Perspective blog to help businesses address those concerns. The four weekly themes are:

Week 1: Be Cyber Smart: Best practices to protect data.

This week elaborates on the tips listed below to help small merchants protect credit card data.

                TIP #1: Reduce where payment card data can be found.

                TIP #2: Use strong passwords.

                TIP #3: Keep software patched and up to date.

                T IP #4: Use strong encryption.

TIP #5: Use secure remote access.

TIP #6: Properly configure firewalls.

TIP #7: Think before you click.

TIP #8: Choose trusted partners.

Week 2: Fight the Phish: Resources to help identify phishing attacks.     

This week’s training covers ways to protect merchants from phishing attacks. Phishing attacks account for more than 80% of security breaches, according to a Data Breach Report Incident done by Verizon.

Week 3: Cybersecurity Career Awareness Week: Consider a cyber career.

This week covers the increasing need for security analysts. According to the U.S. Bureau of Labor Statistics, this need will increase by 33% by the year 2030. It also addresses the shortage of women in this field. Currently, only 20% of the cybersecurity workforce globally are female.

Week 4: Cybersecurity First: Guidance to make cybersecurity an organizational priority.

This week provides information about a 45-minute Work from Home Security Awareness training program that covers basic security training to educate organizations and remote workers on the basics for securely working from home. This program was created so that no previous knowledge of cybersecurity is needed to understand it.

Merchants can take advantage of any or all these resources by going to:

https://blog.pcisecuritystandards.org/cybersecurity-month-working-from-home-security-awareness-training

Cloud services are a great tool for companies of all sizes because they provide access to the latest computer technologies without putting a financial strain on the business to make costly computer investments.  While these companies offer low-cost options for businesses, many of them do not realize that they still have responsibilities regarding payment card information. 

According to Jim Reavis, CEO of the Cloud Security Alliance, “Limiting exposure to payment data reduces the chance of being a target for criminals.  Proper scoping of cloud environments is critical to achieving this goal.”

A misconception many businesses have is that by using a cloud service provider they have no responsibility for data security.  This couldn’t be further from the truth.  Payment card data security is typically a shared responsibility.  Cloud scoping requires that all people, processes, and technologies used that interact with payment card data be identified. 

Jim goes on to say “Cloud computing can be very secure when best practices are employed and all stakeholders understand their shared responsibility, which is learned through proper scoping. While companies of all sizes use the cloud, the knowledge gap is most evident with smaller businesses, which put them at risk of suffering a security incident. We are all in this together.”

To comply with PCI requirements for using a service provider, responsibility for data security must be clearly defined so that both the merchant and the service provider are aware of their responsibilities and requirements.  The merchant must also monitor the service provider’s PCI compliance validation status on an ongoing basis to ensure that they are PCI compliant.

Well over a year into the COVID-19 pandemic, many businesses continue to operate from home offices.  The PCI Security Standards Council, (the Council), estimates that 25-30% of the workforce will still be working from home several days a week at the end of 2021.  In the rush to set up remote work environments last year, many businesses overlooked cybersecurity best practices, leaving them vulnerable to attackers.  With more and more businesses opting to continue working from home, it’s important that any gaps in security are closed. The Council has developed a 45-minute training course designed to help businesses work from home securely.

According to Travis Powell, the Council’s Director of Training Programs, “This training has been designed for all employees, regardless of technical experience. The 45-minute training has been setup as an engaging, self-guided, computer-based training, with content related knowledge checks throughout the training. We designed the training in such a way that no previous knowledge of the PCI Data Security Standard (PCI DSS) is required. In fact, no in-depth knowledge of cyber security is required. We wanted to ensure this training provides basic security awareness and practices to the broader community.to learn more about this new training and the importance of prioritizing security in the remote workforce.

To read more from Travis, go to https://blog.pcisecuritystandards.org/new-training-work-from-home-security-awareness.

In order to make this training available to all merchants who need it, the Council is offering it at a very low price:

• $35 USD/per person for 1-99 employees
• $25 USD/per person for 100+ employees
• Customizable options for organizations seeking to train 500+ employees

For more information, and to register for the training, merchants can go to https://www.pcisecuritystandards.org/program_training_and_qualification/work_from_home_security_awareness

Fashion clothing line retailer Guess has joined the list of companies that have suffered breaches in 2021.  The company announced mid-July that they discovered unauthorized access to some of their systems from February 2, 2021 to February 23, 2021.  Quick detection limited the loss of personal information to just 1,300 people, but the compromised information included account numbers, debit and credit card numbers, social security numbers, access codes, and personal identification numbers.

According to Dirk Schrader, Global Vice President, Security Research at New Net Technologies (NNT), now part of Netwrix, a provider of change management software, "There is a fairly large amount of unanswered questions in this breach notification and the event itself. Why sensitive personal information like SSNs or account details was stored in clear text is one of them. That some data sets were apparently incomplete indicates a lack in managing clean and lean data of its customers. Being stock listed, it will be interesting to read through filings for additional details and whether SEC will ask for more details. Measures to avoid such an incident, companies should make sure to have the essential controls in place."

BleepingComputer believes that the ransomware gang, DarkSide, is most likely the party behind the Guess attack.  DarkSide appears to have been shut down following their cyberattack on the Colonial Pipeline, at which time law enforcement seized portions of their infrastructure.

While this cyberattack may seem small when compared to other attacks, any breach will cause damage to a company.

Hitesh Sheth, President and CEO at Vectra, a San Jose, Calif.-based AI cybersecurity company, says, “Disclosure of the GUESS breach reminds us that not all ransomware attacks are big and ambitious. They come in all shapes and sizes and are as much a fact of life on the digital landscape as fender-benders on the freeway. We’re on the way to a more secure digital future, but in the meantime every business must realize what GUESS learned the hard way: all are potential targets. When all adopt a security-first IT philosophy emphasizing better attack detection, better quality of life will follow.”

After a lengthy delay caused by the pandemic, the PCI Security Standards Council is finally on track to release the long-awaited v4.0.  Much has changed in the payments industry since v3.0 was released in November of 2013, and while there have been updates made to that version, the Standards have lagged behind.

The PCI Counsel plans to release the draft of v4.0 for community feedback in early Q1 of 2022.  They want Qualified Security Assessors (QSAs), Approved Scanning Vendors (ASVs) and Participating Organizations to have time to preview the draft before it is released since it is going to be a significant revision.  The plan is to officially launch        v4.0 in March of 2022.  The timeline they have released includes a transition period of 18 months, which will give organizations time to become familiar with the new standards and to update their documents, such as SAQs, ROCs, and AOCs.  During this 18-month period versions 3.2.1 and 4.0 will both be active; v3.2.1 will be retired at the end of the transition period.  There will also be requirements that are “future-dated” in v4.0 to give companies time to implement the new requirements.  It appears the “future dated” requirements could be extended to Q1 of 2025.

2021 is showing signs of setting a record for the highest data breach volume. In January alone, more data records were compromised than in all of 2017. Imperva, a cyber security company, recently published a report that revealed a total of 878.17 million data records were compromised worldwide in January 2021.  There were 826.53 million records compromised in 2017, with an average number of 1.7 million records per breach.

Report author Ofir Shaty, Imperva security analyst technology lead, said:

“We can estimate that year-over-year we will see around three times more records stolen annually [in 2021],” “The constant increase in data breaches is a result of multiple factors,” he wrote. “We are living in a digitalization era in which more services are consumed on a daily basis with the majority of them online.” “More businesses are migrating to the cloud, which makes them more vulnerable if not done carefully.”

While most of the information stolen in breaches tends to be personally identifiable information, (PII), Imperva reports that 9.2% is payment card data.  Payment card data remains the main target for cyber criminals because of the high demand for it on the Dark Web. 

As we know, 2020 had a huge impact on businesses around the world.  Brick and mortar businesses suddenly went from face-to-face transactions to offering curbside pickup, delivery options, and online ordering.  With businesses desperate to survive, and little to no time to make the transition, many were left open to security breaches.

Based on current trends, Shaty predicts that 2021 will see approximately 1,500 breach incidents with a total of 40 billion compromised records and an average of 26 million compromised records per breach.

Visa first announced plans to migrate to EMV chip transactions ten years ago, in 2011.  Recognizing that it would take longer for fuel pumps to be capable of complying, the date was extended, first to 2017, then 2020, and finally, to April of 2021.  As another date has come and gone, it’s estimated that roughly half of all US fuel pumps have yet to be upgraded. 

The benefit to upgrading pumps is clear.  Counterfeit fraud rates declined 22%, and counterfeit fraud dollars declined by 32%, during the first ten months of 2020 according to Visa. At the end of February 2021, VisaNet reported that approximately 51% of transactions processed through fuel pumps in the US were EMV.

Low conversion rates, already blamed on the limited number of technicians available to go on-site, have been further impacted by Covid.  Debbie Guerra, the executive vice president at ACI Worldwide said,

“While EMV compliance is a major undertaking, and one that requires a significant capital investment, there is no doubt that the pandemic also played a big role in some fuel merchants’ inability to meet the April deadline. With overall diminished resources due to the pandemic and slow testing and certification, which is typically done in person, merchants have certainly been challenged,”

The ACI survey results indicate that it may be a while before the stations they surveyed will be EMV compliant.  Half of the 52% that are not fully compliant said they do not know when they’ll be able to become compliant. 

To help eligible business owners who’ve yet to upgrade their pumps to process EMV transactions combat fraud at the pump in the meantime, Visa Transaction Advisor has been automatically enabled for one year. Visa Transaction Advisor is invisible to the cardholder while providing a layer of fraud protection to the merchant. 

Responding to the increasing number of attacks targeting third-party payment applications, the PCI Security Standards Council published an update to the PCI Secure Software Lifecycle Standard last month. 

“This update to our Secure SLC Standard and Program is a key step in promoting greater implementation by expanding eligibility to vendors that produce software and software components that may share resources within a payment environment,” Emma Sutcliffe, senior vice president, Standards Officer for PCI Security Standards Council said in a prepared statement.

Evolving security threats require frequent, on demand, updates to software.  The PCI Secure SLC Standard v1.1 is designed to make it easier for developers to follow the Secure Software Lifecycle Standard by ensuring that proper assessment procedures are in place throughout the development lifecycle.  Historically, updates had to be certified as being in compliance before they could be released, significantly slowing implementation. With this change, developers are only required to demonstrate compliance annually, allowing them to issue updates much quicker.

“We knew we needed an updated standard that provided more flexibility in creating lifecycle security controls around payment data within applications and enables developers to come to market faster with applications and updates even as security threats evolve,” says Troy Leach, senior vice president and engagement officer for the PCI Security Standards Council. 

One of the more serious threats that the new Standard can address is digital skimming.  Digital skimming allows hackers to steal card data as the consumer enters it into a web form, or via a mobile app, making it more difficult to detect since the data is stolen before it reaches the merchant’s server.  “Attacks against payment data are becoming more sophisticated and harder to detect,” Leach says. “The updated standard puts an application through rigorous testing to assure users it is secure. Once that methodology is in place, over time it will become an easier and more robust way for developers to follow the standard.” 

With the implantation of the new Standard, the PCI Security Council will retire the Payment Application Data Security Standard, (PA-DSS) in October of 2022.

Thieves have had a field day exploiting the covid-related e-commerce boom and have now added a new trick - taking advantage of curbside-pick up.  With a huge number of merchants now using this to attract retail customers who are uncomfortable shopping face to face, this has become an easy target for thieves because of the lack of controls in place. 

According to Julie Conroy, the research director for Aite Group, “there is a whole class of merchants that have had to contend with e-commerce and card-not-present transactions that never had to prior to the pandemic, so it’s no surprise that this type of fraud is rising,” Conroy says. “We are constantly hearing from merchants [that] there has been a 25%-to-30% uptick in card-not-present transactions during the pandemic and that card-not-present fraud is rising at a commensurate rate.”

The Aite Group projects that there will be $7.9 billion in card-not-present loses in 2021, up from an estimated $7.2 billion in 2020.  Another e-commerce fraud being used is enumeration fraud. For this method of fraud, automated programs are used to try different combinations of payment data from e-commerce transactions to identify the account number, CVV2 code, and/or expiration date.

According to Visa Inc.’s Biannual Payment Ecosystem Report, “threat actors adapted to the Covid-19 pandemic by illicitly creating and subsequently using Covid-19-related merchant names to conduct enumeration attacks, as well as targeting donation related merchants.”

Point-of-sale malware attacks are also rising. With this method, thieves target e-commerce merchants to obtain compromised payment accounts by sending a merchant a phishing email that launches the malware into the merchant’s POS system when opened or when the merchant clicks on a link in the message.    

“These types of attacks are a throwback to the days before chip cards, when mag-stripe data was stolen for counterfeit cards,” says Conroy. “Today, counterfeit cards can only be used at merchants that don’t have terminals with chip readers or online merchants that don’t require a CVV2 number.  Another problem around POS malware is that criminals typically target small merchants for attack and then repackage the data into a large bundle for sale on the dark Web. When the data is sold in bulk, it becomes difficult to detect the actual point of compromise," Conroy says.

New year, new breach are not words that are unfamiliar to us.  We’ve come to expect that a new breach will be announced at the beginning of each year, it’s just a question of who will be the “lucky” one to kick things off.  Bonobos, a men's clothing retailer, appears to hold that honor for 2021.

Bonobos started out selling online only, then expanded to include brick and mortar locations, ultimately opening 60 stores.  In 2017, Bonobos was bought by Walmart for $300 million, with the expectation that Bonobos’ clothing would be sold on Walmart’s Jet.com site. Earlier this month, Bonobos notified customers that they were the victim of a massive breach.  The exact time frame of the breach is not yet known, but some of the data stolen dates back as far as 2014, with some data from as recent as July of 2020.  The company learned of the breach after an attacker known as ShinyHunters dumped Bonobos’ database to a free hacker forum.  ShinyHunters is well known for hacking online services and selling databases that have been stolen.

The attacker released 70 gigabytes worth of data, including customer addresses, phone numbers, partial credit card numbers, order information, and password histories.  Thus far, they have found that 7 million customer phone numbers and addresses have been stolen, 1.8 million customers have had account information, including passwords, compromised, and 3.5 million partial credit card numbers have been stolen.

Bonobos said that the information was not accessed from their system.  It was accessed from the external cloud platform they use to back-up their files.  Once again, failing to ensure that vendors with whom sensitive data is shared has resulted in a breach that has compromised customer information.

As the pandemic rages on, payment card security continues to be a challenge.  Unfortunately, it’s a challenge many organizations are failing to meet.  This year’s Verizon Data Breach Investigations Report found that for the third year in a row compliance is on the decline, with a 27.5% drop since 2016. 

Payment card data continues to be one of the most lucrative targets, accounting for 9 out of 10 data breaches by cybercriminals.  In the retail industry, 99% of breaches were focused on stealing payment card data for criminal purposes. 

The report goes on to state that on average only 27.9% of global organizations maintained full compliance with the PCI DSS.

“Unfortunately we see many businesses lacking the resources and commitment from senior business leaders to support long-term data security and compliance initiatives. This is unacceptable,” said Sampath Sowmyanarayan, President, Global Enterprise, Verizon Business.

“The recent coronavirus pandemic has driven consumers away from the traditional use of cash to contactless methods of payment with payment cards as well as mobile devices. This has generated more electronic payment data and consumers trust businesses to safeguard their information.

“Payment security has to be seen as an on-going business priority by all companies that handle any payment data, they have a fundamental responsibility to their customers, suppliers and consumers.”

With companies transitioning to remote working environments almost overnight, the increased burden of ensuring that all those new work “locations” are operating in a secure environment, may mean further drops in compliance rates for 2020. 

As far as specific problem areas go, the biggest areas of non-compliance were as follows:

Covid-19 has forced many businesses to significantly change their business model.  One of those changes is that more employees who have access to payments data are working from home.  Shifting to home from the office/storefront, coupled with travel restrictions, has made it difficult, if not impossible, for onsite inspections to take place.  Recognizing that changes to the payment landscape equal changes to the merchant’s capability to comply, the PCI Security Standards Council has announced plans to make the next version of the security standard more reflective of changes in the workplace.

“With more employees working remotely, there needs to be a new approach to protecting payment data,” says Troy Leach, senior vice president for the PCI council. “The standard also needs to recognize there may be circumstances that prevent an assessor from conducting an onsite assessment, such as travel advisories or restrictions relating to coronavirus, and that result in the assessment being conducted remotely.”

None of this means that standards are being lowered – no matter where the work is being done, there are always steps that can be taken to maintain a secure environment.  Those steps include reviewing security policies with employees, and checking audit logs for any changes that may have created a vulnerability.   “Our aim is to rethink how remote assessments are performed without increasing the risk of the assessment” says Leach.

“Most PCI data-security standard requirements are a demonstration of a process,” says Leach. “As the work environment changes, [data-security] processes must change with it.” 

Leach went on to say that making adjustments to accommodate remote workers is not expected to be a temporary trend.  Many companies have already made plans to continue to work remotely even after the pandemic ends.   Making sure that employees who continue to work from home understand how to protect data long term will require continuing education, as well as independent testing to verify that the remote workplace is secure.

“This was something that was being discussed prior to the pandemic,” says Leach. “Covid-19 just accelerated the discussion, because remote work will continue to be the norm for the foreseeable future.”   

 “The disruption from the Covid-19 pandemic is changing the payment industry,” says Leach. “That’s why version 4.0 of the standard is going to be more flexible.”

Over the past few years, various online subscription box companies have emerged and many have become extremely popular.  What’s not to love about paying a set monthly fee, and receiving a box of surprise items based on your likes?  FabFitFun suffering two Magecart attacks in a four-month period may take some of the enjoyment out of those boxes filled with surprises.

FabFitFun subscription service released a notification informing their customers that they suffered the initial attack between April 26, 2020 and May 14, 2020, then the second from May 22, 2020 until August 3, 2020.  During these time frames, there was an active skimmer running on their payment page which exposed emails and passwords for PayPal or Apple Pay, along with names, addresses, payment card account numbers, card expiration dates, and card verification codes.

            While it is not unusual for hackers to attempt a Magecart reinfection, it is unusual that they were successful.  That indicates that the company did not take the proper steps to secure their data when the first breach was discovered in mid-May, which left their cardholders vulnerable until August 3, 2020, angering many of their customers.  One customer not only got angry, she took action – Cheryl Gaston alleges in a proposed class action suit filed this month in the US District Court for the Central District of California that the retailer acted negligently and violated the Colorado Consumer Protection Act when it failed to safeguard customer data.

Allegations made in the filing include:

16. Defendant does not claim that it abides by the Payment Card Industry Data Security Standard (“PCI DSS”) compliance, which is a requirement for businesses that store, process, or transmit payment card data.

17. The PCI DSS defines measures for ensuring data protection and consistent security processes and procedures around online financial transactions. Businesses that fail to maintain PCI DSS compliance are subject to steep fines and penalties.

18. As formulated by the PCI Security Standards Council, the mandates of PCI DSS compliance include, in part: Developing and maintaining a security policy that covers all aspects of the business, installing firewalls to protect data, and encrypting cardholder data that is transmitted over public networks using antivirus software and updating it regularly.

Based on information released to date, it appears unlikely that the hackers would have been successful in stealing this data had FabFitFun been PCI compliant.

The law of supply and demand is as true in cybercrime as it is in business.  With many brick and mortar businesses locked down or closed, counterfeit cards are not as “useful” as they were prior COVID-19.  Gemini Advisory, a cyber intelligence firm based in New York that closely tracks dark web stores that traffic in stolen card data, reports that the decrease in demand has resulted in significantly lower prices in the underground.  Stas Alforov, Gemini’s director of research and development, told KrebsOnSecurity “Gemini Advisory has seen over 50 percent decrease in demand for compromised card present data since the mandated COVID-19 quarantines in the United States as well as the majority of the world.”  Alforov said the average price for card-present data - card numbers stolen from hacked brick-and-mortar merchants with the help of malicious software installed on point-of-sale (POS) devices - has dropped significantly since the beginning of 2020.

With the increase of online sales this year, the demand for stolen “card-not-present” data has remained high.  Gemini found prices for this data have actually increased slightly since the beginning of the year.

What does the increasing shift to card not present fraud coupled with significantly fewer transactions being processed by smaller online retailers mean?  Andrew Barratt, an investigator with Coalfire, a cyber forensics firm, reports a new COVID-19 dynamic going on with e-commerce fraud that is making it harder for banks and card issuers to trace patterns in stolen card-not-present data back to hacked web merchants — particularly smaller e-commerce shops. “One of the concerns that has been expressed to me is that we’re getting [fewer] overlapping hotspots,” Barratt said. “For a lot of the smaller, more frequently compromised merchants there has been a large drop off in transactions. Whilst big e-commerce has generally done okay during the COVID-19 pandemic, a number of more modest sized or specialty online retailers have not had the same access to their supply chain and so have had to close or drastically reduce the lines they’re selling.”

A basic anti-fraud process known as “common point of purchase” or CPP analysis, involves comparing transactions run on fraudulent cards to determine the merchant location that was targeted.  With fewer transactions, this has become much more challenging, particularly at smaller retailers

“With a smaller transactional footprint means less Common Point of Purchase alerts and less data to work on to trigger a forensic investigation or fraud alert,” Barratt said. “It does also mean less fraud right now – which is a positive. But one of the big concerns that has been raised to us as investigators — literally asking if we have capacity for what’s coming — has been that merchants are getting compromised by ‘lie in wait’ type intruders.”

Barratt suspects that hackers are essentially biding their time, waiting for smaller online merchants to see an increase in volume, putting the hackers in a better position to mix the sale of cards stolen from many hacked merchants and further confound CPP analysis efforts.

“These intruders may have a beachhead in a number of small and/or middle market e-commerce entities and they’re just waiting for the transaction volumes to go back up again and they’ve suddenly got the capability to have skimmers capturing lots of card data in the event of a sudden uptick in consumer spending,” he said. “They’d also have a diverse portfolio of compromise so could possibly even evade common point of purchase detection for a while too. Couple all of that with major shopping cart platforms going out of support and furloughed IT and security staff, and there’s a potentially large COVID-19 breach bubble waiting to pop.”

COVID-19 may have diverted thieves’ attention away from brick and mortar theft, but it has not stopped them from attacking companies.  Since the beginning of the pandemic there has been an increase in email phishing attacks, but one group of bold thieves are taking phishing to a new level.  They are marketing a voice phishing service, also known as vishing, to steal VPN credentials from unsuspecting employees. These attacks typically start with a paid request from thieves to target specific companies, or employees.  A typical vishing group requires at least two people.  One person will have a one-on-one phone call with the unsuspecting target, while their co-conspirator uses the compromised credentials to log into the company’s actual VPN in real-time.  From there, they can take control of the company’s website and email accounts.

The attackers go to great lengths to make this scheme seem believable.  They start by creating phishing sites that mimic the company they are attacking.  These sites usually include the company’s name followed or preceded by terms such as VPN, ticket, or portal.  The sites often include working links to the company’s own internal online resources.  To increase the feel of “legitimacy”, attackers will often then create LinkedIn profiles, and connect with other employees within the targeted company to increase believability.  They’ve even managed circumvent some types of multi-factor authentication because their fake sites can be setup to request the one-time code.

Once the site is created, they move on to contacting the merchant on the phone.  The thieves typically target new hires because they are not as familiar with other employees.  They will pose as someone from the company’s IT department with the goal of convincing the employee to provide them with their VPN credentials, or to have the employee input the credentials into the bogus site they created.  Once the thieves are in, they quickly try to locate any digital information that can be used for quick financial gain.

What’s a merchant to do?  This is where security training is crucial.  Constantly reinforcing security policies with employees and educating them on the importance of securing all information, prevents thieves from exploiting employees and gaining access to financial data.

Due to the global pandemic, many people have turned to using online grocery shopping services to keep themselves safe from being exposed to Covid-19 at their local grocery stores.  One of these services, Instacart, has seen its customer base grow significantly since March when the pandemic caused shutdowns across the United States and Canada.  While they’ve been scrambling to hire hundreds of thousands of people to keep up with the increased demand, it appears that thieves decided to help themselves to their data.

On July 22, 2020, BuzzFeedNews announced that Instacart may have suffered a breach.  The names, the last four digits of credit card numbers, and order histories of almost 300,000 Instacart customers were found in two stores on the Dark Web. An Instacart spokesperson released a statement to BuzzFeedNews denying a breach.

“We are not aware of any data breach at this time. We take data protection and privacy very seriously,"

Since news of the potential breach was announced, Instacart has stated that they believe the accounts were accessed thru credential stuffing.  Credential stuffing is a type of cyberattack that uses stolen login credentials from one site or service to attempt to access various other sites and services.

This loss of data could have been avoided, had Instacart had two-factor authentication in place.  Using two factor authentication adds an additional layer of security, which many thieves would not have been able to penetrate.  Even though Instacart states, “We take data protection and privacy very seriously", it has been reported that they do not support two-factor authentication, and when asked about their plans for implementing it, they have no comment.

Just as the US is seeing new surges in Covid-19 cases, there are concerns that merchants may soon see a surge of data breaches.  When retailers were forced to close the doors of their brick and mortar locations, with little-to-no advance notice, back in March and early April, they were sent scrambling to adapt to a “new normal”.   Efforts were devoted to finding ways to process contactless payments, make contactless deliveries, and generally stay in business.  While they were busy trying to survive, hackers were quietly planting malware to allow them to skim payment card details.

One retailer to fall victim to this is Claire’s, a jewelry and accessories retailer.  Claire’s, along with Icing, their sister company, announced that they have been the victim of what is believed to be a Magecart attack. Magecart attacks are typically initiated by hackers who use malware to insert harmful code into a company’s website. Once they insert their own code within the website’s existing code, it can then be used to gather information entered during the checkout process without making any change to the transaction process.

In this case, the Magecart attack began skimming payment card information from Claire’s’ website around April 20, but it is believed to have been inserted as early as March 20, the day after Claire’s physical locations were closed due to Covid-19. The combination of an increase in online traffic and a reduced workforce available to oversee any possible threats, allowed hackers to skim payment card data for nearly two months before it was discovered by researchers at Sansec, a security firm.  While the investigation is still ongoing, Claire’s has determined that no in-store transactions were compromised.

“Any crisis is a green light to cybercriminals and scammers,” said Jim Van Dyke, CEO of Breach Clarity, a San Francisco fraud prevention and detection technology firm. “COVID-19 has created an enormous amount of uncertainty and chaos at a scale we’ve not seen before. People are scared, anxious and desperate for anything that might help them through this troubling time. That makes them incredibly vulnerable. And, if you consider their private information is floating around the dark web, just waiting to be purchased by an opportunistic scammer, it’s the perfect storm.”

In light of changes and delays brought on by the COVID-19 pandemic, the PCI Security Standards Council has announced that they are delaying the release of version 4.0.  This version was originally expected to be released late this year, with a one-year window for merchants to comply with the new standards.  In order to allow sufficient time for the Council to review comments generated by the Request for Comment issued previously, as well as another that they expect to issue in October of 2020, they have announced that PCI DSS version 4.0 will be published sometime in 2021, with a two year window to comply with the new standards.

As a reminder, the PCI Security Standards Council has released a resource guide, found at https://blog.pcisecuritystandards.org/8-tips-for-small-merchants-protecting-payment-data-during-covid-19 to help small merchants keep their customers’ payment data secure in this rapidly changing environment.

In addition to this resource for small merchants, the Council has established resources for all COVID-19 updates, which can be found by going to https://www.pcisecuritystandards.org/covid19.

Over the last few weeks, companies across the US have found themselves forced to set up remote access to systems to allow employees to work from home.  While some companies have maintained a remote work environment for years, many businesses have had to scramble to comply with government orders that have typically been issued with little to no advance warning.  Even companies who have previously maintained a remote workforce have been faced with the challenge of having as much as 100% of their workforce working from home.  Inevitably, with the lack of ramp up time, coupled with the general anxiety of coping with a pandemic, this translates into opportunities for hackers to access far more networks than ever before.  While this may not seem to be a huge risk for many companies, let’s not forget that the Target breach did not originate with them, it began by hackers accessing an HVAC company that happened to have remote access to Target’s stores. 

Businesses should be more vigilant than ever to protect against network intrusions, phishing campaigns, and bogus requests for financial data. Crooks are taking advantage of COVID-19 fears, rapidly changing work environments, and a distracted workforce to trick individuals into clicking on links, visiting websites and opening emails that contain malware. The threats come from a number of sources, including targeted attacks against the health and life sciences industry, and bad actors posing as CDC or WHO representatives. 

Fortunately, just as washing our hands reduces the risk of getting COVID-19, there are basic security steps that can be taken to also reduce the risk of cyberattacks:

• Never open attachments in unsolicited emails.
• Never click on links in unsolicited emails.
• Never provide personal or financial information in response to online solicitations or unsolicited email.
• Educate yourself on how to spot phishing attacks, including sophisticated messages and spoofed emails.
• Use only trusted sources like verified government websites for COVID-19 information.
• Never donate to charities without first verifying their authenticity.
• Never download unauthorized or unsupported software on any device used to access company networks.
• Be sure that software and settings on all devices used to access company networks are secure and regularly updated with all security patches.
• Update home Wi-Fi routers to the latest firmware and use strong Wi-Fi passwords

Our country is facing an unprecedented time. The MAXpci team sends our very best wishes to every one of you, your family and friends.  Stay home and stay healthy.  Together, we will get through this.

Application program interfaces, also known as APIs, are becoming increasingly popular because they automate the process of sending information between different platforms.  Crooks agree.  They are also becoming increasingly interested in this process, because it provides them another means of gaining access to data.  So much so that Akamai Technologies reports that criminals launched more than 16.6 billion attacks against the points of access in API connections between December 2017 and November 2019. 

Criminals use a method known as credential stuffing to attempt access to APIs and other web-based applications.  Credential stuffing uses stolen username and password combinations from a previous breach to attempt to gain access to other accounts.  Yet another reason not to use the same credentials for multiple accounts.

With APIs catching the interest of so many criminals, how does a merchant protect themselves?  Steven Ragan, security researcher from Akamai has recommendations that fall in line with PCI standards.

“Payments companies can take several steps to protect their API connections. Limiting the rate of access and protecting the APIs directly is a start.  Enabling and enforcing strong multifactor authentication processes is another layer of defense,” Ragan says. “In addition, education about the use of password managers, multifactor authentication tools, and phishing is [another] step.”

Last month we reported that Wawa had suffered a breach that lasted over nine months.  Once the malware was found, it was quickly contained; however, the damage was already done. The breach exposed debit and credit card numbers, expiration dates, and cardholder names of customers that made purchases at any Wawa.  On Monday, January 27, 2020, a popular underground crime shop known as Joker’s Stash claimed to have 30 million records for sale, many of which can be traced back to purchases made at Wawa.  This batch of cards has been named “BIGBADABOOM-III” by Joker’s Stash.

Wawa released a statement to KrebsOnSecurity regarding the claim by Joker’s Stash.

“We have alerted our payment card processor, payment card brands, and card issuers to heighten fraud monitoring activities to help further protect any customer information. We continue to work closely with federal law enforcement in connection with their ongoing investigation to determine the scope of the disclosure of Wawa-specific customer payment card data. We continue to encourage our customers to remain vigilant in reviewing charges on their payment card statements and to promptly report any unauthorized use to the bank or financial institution that issued their payment card by calling the number on the back of the card,” the statement continues. “Under federal law and card company rules, customers who notify their payment card issuer in a timely manner of fraudulent charges will not be responsible for those charges. In the unlikely event any individual customer who has promptly notified their card issuer of fraudulent charges related to this incident is not reimbursed, Wawa will work with them to reimburse them for those charges.”

A New York-based fraud intelligence company, Gemini Advisory said the largest amount of card information for sale traced back to Wawa customers in Florida and Pennsylvania.  Gemini Advisory also said that only a small portion of the 30 million cards they claim to have, are currently for sale.  Joker’s Stash will not release too many cards at one time because it will drive down the selling price.  Currently, the price is $17 per card with some international cards selling for as much as $210 per card.

It’s estimated that this breach will cost Wawa millions of dollars in fines.  The total impact remains to be seen; there has already been one class action suit filed against the company.