A data breach at 22 Shaw's supermarkets in Maine exposed millions of credit and debit card numbers between June and July 2014. Security expert Robert Siciliano explains that magnetic-stripe cards store data in plain text, making them vulnerable, and recommends monitoring statements and considering identity-theft protection.
We are learning more tonight about the massive data breach affecting about a dozen— two dozen, in fact— Shaw's stores around Maine. One security expert tells CBS 13 that millions of card numbers were likely stolen. CBS 13's John Caruso is on your side with what you need to do now if you're a Shaw's shopper. John.
And many of you have reached out to us looking for some guidance on what to do next and wanting more information about what happened. It's been 5 days now since the parent company of Shaw's disclosed its credit and debit card network was hacked, impacting potentially 22 stores in Maine. Today, the company said it is working closely with its third-party IT provider, SuperValu, to better understand the nature and scope of the incident. But that's little comfort to shoppers wanting answers now. So we reached out to national ID theft expert Robert Siciliano with Hotspot Shield for some perspective on this. He says millions of card numbers were likely stolen during the data breach. We now know it stretched nearly a month, impacting those who shopped at Shaws between June 22nd and July 17th. This breach, like the Target breach, experts say is a reminder that hackers will keep finding more sophisticated ways to get precious debit and credit card data while new technology is evolving.
Yeah, there is a, uh, move right now to get what's called EMV, or chip and PIN, which is the next level up of credit card protection. It is a new type of credit card that has a chip in it, and it doesn't have that magnetic stripe. The problem with that magnetic stripe is it stores the data in plain text.
And because of that, it is important to check your credit and debit card statements, in this case going back to June. If you find unknown charges or suspicious activity, you do want to contact your bank or credit union right away. You are protected under state and federal law from unauthorized use. If account numbers are stolen, consumers have no liability. With debit cards, though, you only have 60 days to report unauthorized activity before you're liable. Shaw's is also offering Advanced Identity Protection for free, but you need to sign up for it, which the Attorney General's Office is strongly suggesting. The steps on how to do that are on our website, wgme.com. John Cuisous, CBS 13 News.
