Criminals posed as technicians and swapped out PIN pads at 80 Michaels stores across 20 states to steal card numbers and PINs. Debit card fraud must be reported within 2 days, credit cards within 60 days. McAfee's Robert Siciliano explains why this hardware swap is bolder than past retail hacks.
Chapters
A warning tonight if you shopped at Michaels. That's a popular arts and crafts store nationwide. The company announced today that the PIN pads at stores in 20 states were tampered with. That includes stores in Massachusetts, New Hampshire, and Rhode Island. Eileen Curran joins us now. And Eileen, we're talking about people's credit and debit card information, right?
Yes, John, their card numbers and PIN numbers. Now, Michaels officials say right now they aren't sure how many people this affects or how long it's been going on, but if you have shopped in their store, you'll want to keep a close eye on on your credit and debit card statements because you could very well be a victim.
Jeanne Ploinsky makes jewelry and buys her supplies at Michaels. She was not happy to learn thieves had breached the security of the company's credit and debit card system.
They're thieves, that's all I can say. They're just outright thieves and I think it's horrible.
Michaels officials first announced a problem with its Chicago stores earlier this month, but now say the breach is more widespread. Nationwide, 80 stores have been affected, including 6 in New England. 4 in Massachusetts— Braintree, Burlington, Danvers, and Everett.
1 in Amherst, New Hampshire, and 1 in Warwick, Rhode Island.
How is this a big corporation and they got breaches going on as far as with your credit card? That's no good.
The thieves compromised the PIN pads where customers swipe their cards and enter their PIN numbers. McAfee security consultant Robert Siciliano of Boston says they actually replaced the store's hardware.
So what the bad guys do is they show up at the chain, the retail chain, posing as the service technicians for these devices and that they have to come in and swap them out or repair them.
In 2007, the TJX company had a security breach that affected more than 45 million customers. Michaels officials can't or won't say how many customers have been affected in this breach. They say their investigation continues. Their head of security released this statement, quote, we have determined which stores had affected PIN pads, but we do not know whether cardholders in those stores were involved.
Once you swipe your card into a compromised device, you're victimized.
The breach has some customers rethinking how they'll pay for their purchases.
I better use cash, I guess.
Yes, I probably won't use it now.
But not Jeanne Ploinsky.
I still use my credit card. You know, you have to live.
You have to live. Well, if you've shopped at these stores, you'll want to keep an eye on your statements and report any discrepancies. You have 60 days to dispute a credit card charge, but only 2 days for a debit card charge. John?
Eileen, any idea how this compares to that breach at TJX?
Well, as far as how they pulled it off, TJX was a wireless hacking that was done. And in this case, the thieves actually replaced the actual hardware in the stores, those PIN pads. So in some respects, this was a lot bolder.
