Staples revealed this week that it is investigating the possibility that payment card information from the store's customers was compromised in a breach. The office supply chain has more than 1,800 locations in the U.S., but the breach seems only to have affected a handful of stores in the Northeast. Stores involved in the intrusion include seven in Pennsylvania, one in New Jersey and at least three in New York City.
According to security researcher Brian Krebs, who first broke the story, multiple banking sources have identified "a pattern of credit and debit card fraud" that is consistent with data breach activity. The transactions that alerted the banks to the intrusion took place at non-Staples locations, like grocery stores and other retailers, suggest that Staples' point of sale systems were likely infected with malware. The malicious software could steal credit card data stored on the POS terminals and provide cybercriminals with information to create counterfeit cards.
Staples hasn't been faring the shift to the e-commerce landscape well. The retailer has said it plans to close 225 locations by the end of 2015 in order to cut $500 million in costs to stay competitive. The possibility of a data breach won't help to encourage customers to come to the store, likely causing sales to drop even more at a time when the company can least afford it.
Retail data breaches on the rise
Staples joins a not-so-exclusive club of major retailers falling victim to a data breach, something that has grown increasingly common in recent months. The U.S. is making strides toward the adoption of chip and PIN payment card technology, but until the transition is complete retailers and their customers will remain vulnerable. According to officials with the Department of Homeland Security, the complete migration and implementation of such payment systems is still a few years away.
James Huguelet, principal at PCI consultancy The Huguelet Group LLC, noted in an interview with Dark Reading that the recent rash of data breaches targeting retailers is concerning, and likely not going away anytime soon.
"While I can only speculate as to why 2014 is proving to be the year for POS breaches, we've clearly passed some sort of tipping point," said Huguelet. "The Target breach seems to have demonstrated to the cyber underground that these systems are often vulnerable and worthy of the time and effort to attack."
Until more secure chip and PIN cards are widely-available in the U.S., retailers and their POS systems will continue to be a prime targets for cybercriminals looking to make a quick buck. Many companies don't realize their payment terminals have been compromised until sometime after the intrusion because the activity on those systems are not related to what is happening on the rest of the network. This can cause major problems for retailers and can make a bad problem much worse if it is not detected.
To ensure any suspicious behavior is identified as soon as it occurs, enterprises would do well to deploy a security information and event management solution. SIEM services provide companies with around the clock network monitoring, creating actionable cybersecurity data that allows them to make educated decisions about their security posture. With a concierge SIEM service, businesses can ensure they will know about a security incident as soon as it occurs and be able to mitigate its effects in an efficient and reliable manner.