In a Fox Boston news segment, anchor Sarah introduces the recent data breach at Michaels, an arts‑and‑crafts retailer that may have exposed nearly three million credit cards. The breach, which occurred between May 8 2013 and January 27 2014, involved previously unseen sophisticated malware that experts suspect could be related to the earlier Target/Neiman Marcus attacks. Identity‑theft specialist Robert Siciliano explains that the compromised data is primarily credit‑card numbers (and possibly addresses), not Social Security numbers, and describes how criminals use this information for account‑takeover fraud. He contrasts the vulnerable magnetic‑stripe cards used in the U.S. with chip‑and‑PIN technology common abroad, noting that the lack of encryption makes magnetic‑stripe data an easy target. Siciliano advises consumers, especially Michaels cardholders, to closely monitor their credit‑card and store statements for unauthorized charges and to dispute any fraudulent activity promptly. The segment underscores the ongoing risk of data breaches and the need for stronger card security standards.
Chapters
Sarah, thank you. Another security breach to report. Michaels is the latest store hit by hackers. The arts and crafts chain says nearly 3 million cards have been potentially affected. The breach took place between May 8th, 2013 and January 27th of this year, so quite a while. We bring in Robert Siciliano, identity theft expert and McAfee consultant. Robert, always nice to see you. Unfortunately, we always seem to be talking about these breaches.
Yeah.
Which continue to happen. 3 million credit cards potentially impacted here. I mean, Michaels says there's no evidence any other personal information such as names, addresses, uh, credit card numbers were revealed, but what could be at risk here?
Yeah, déjà vu, right? Credit card information, and that means that bad guys are probably processing those cards right now, placing fraudulent orders. We call this account takeover. They take over their existing accounts, they make unauthorized charges, and if you're not paying attention to your statements, you end up paying for those goods and services.
You know, Michaels noted that malware used in the attack was highly sophisticated. They say had not been encountered previously by their security firms. I mean, what does that What does that say to you?
Yeah, it's looking like this is potentially part of the Target/Neiman Marcus breach. Malware that had not been seen before, but that's the detected it, but they were not paying attention to those bells and whistles. That being said, Michaels got caught off guard like the others did and results in $3 million, and you better be paying attention to your statements.
We always know that. You've, you've You've totally told us about that, it seems, almost every single time. You know, these attacks, they get more and more sophisticated. It's the United States and its companies— are we behind? I mean, where is the problem here? Where are we losing out and finding these hackers are able to come and penetrate these companies?
So the rest of the world has what's called chip and PIN, and that's all of Europe and Asia, even Canada, and now even Mexico has chip and PIN, which means it's a smart card technology, a little chip built into the credit card, and then a PIN code is entered. Right now, what we have is a magnetic stripe. If you look at the back of your credit or debit card, you see a strip— that's a magnetic stripe— and the data is in plain text, which means it's easy to read. It's not encrypted. That being said, until we have chip and PIN, at a minimum, these breaches will continue because our data is a big target in plain text.
When people think about their information being stolen, and what type of information is— does it include your Social Security number? I mean, we all know How valuable that can be.
With these types of breaches, so far it's been mostly credit card information. Until they get access deeper into the servers that has, um, client records in regards to signing up for new store cards, you know, that's when your social is used to apply for credit. Unless it's that type of breach, it's just credit card information, which sometimes might mean an address, but mainly it's just credit card information.
Real quickly, if you have a Michaels card, what should you be doing? Pouring over the statement?
You should be paying attention to your Michaels statement. You should be paying attention to your credit card statement, making sure that there aren't any unauthorized charges and refuting any unauthorized activity as quickly as possible.
Good advice. Robert Siciliano, identity theft expert and McAfee consultant. Always appreciate talking with you.
