In this Al Jazeera America news segment, anchor Mark Schneider and host (Speaker C) discuss the widening scope of retail data breaches following the high‑profile Target hack. They cite cybersecurity firms IntelCrawler and EyeSight Partners, which report at least six additional U.S. merchants compromised by the same point‑of‑sale (POS) malware that stole millions of credit‑card records from Target. The Department of Homeland Security is collaborating with these firms to characterize the new malware and has issued a defensive report for retailers. The segment then reviews other major 2013 breaches (Federal Reserve, Washington State Courts, Evernote, LivingSocial) before bringing in Robert Siciliano, an online security expert from McAfee. Siciliano explains that many retailers had robust security measures—encryption, firewalls, layered defenses—but the attackers’ tools were sophisticated enough to evade detection. He emphasizes the technology gap between attackers and defenders and stresses that security must be predictive and multi‑layered. Finally, he offers practical advice for consumers whose data may have been compromised: regularly monitor bank and credit‑card statements, use mobile banking apps, and stay vigilant daily.
Chapters
Al Jazeera America.
Take a new look at news.
Our coverage of spying, prying, and privacy continues now with the focus on a growing security risk to everyone. Hackers are carrying out cyber attacks every day. Stores and their customers are at risk. The hacking of Target customer data made headlines, and we heard other retailers were hit too. And now we're learning that the threat is much bigger.
It's looking more like Target and Neiman's aren't the only retailers hackers are going after. Cybersecurity firm IntelCrawler says it's alerted law enforcement and Visa about other breaches. At least 6 at US merchants that have not been named. The firm says it's the same type of software that was used to steal millions of customers' information from Target.
ATM, cash, that's it. I mean, I can't do it no other way.
You have a check card, but you wouldn't swipe it at a store?
No, I don't trust it. I don't carry it with me because people can walk by and scan it and get your information. I don't do that anymore.
A cybersecurity firm out of Dallas, EyeSight Partners, says it started noticing malicious software codes on the black market last summer. The company explains the so-called malware infects point-of-sale terminals, sends out the stolen information, and then deletes the files. But the firm won't say if that malicious software specifically affected Target, Neiman's, or other retailers. The Department of Homeland Security is working with the cybersecurity firms and says they are looking to, quote, characterize a new identified malware associated with point-of-sale data breach investigations. They put out a report to retailers on how to better defend themselves. Meantime, the CEO of the cybersecurity firm says he expects more attacks to be launched on retailers. Suggesting copycats will use similar and easy-to-find software to steal from customers. Mark Schneider, Al Jazeera, Dallas.
Let's take a look at some of the other major hacking attacks from last year. The Federal Reserve's internal website was hacked, affecting 4,000 bank executives. Cyber thieves got a hold of 160,000 Social Security numbers and 100 million driver's license numbers at the Washington State Courts Office. The million users were comprised at Drupal, the content management platform, but the two biggest cyber attacks, 50 million users breached at the note-taking website Evernote. Now hackers stole personal information for another 50 million users on the popular website LivingSocial. Robert Siciliano joins us now from Boston. He's an online security expert from McAfee. Robert, welcome.
Good evening.
What is the most alarming element of the warning we heard from Homeland Security yesterday?
Well, the fact that, uh, many of these retailers have known about, um, a potential exploit, uh, and essentially didn't or were unable to detect it on their networks is concerning. Uh, more than likely from the reports that are coming out right now, uh, this malware has been around for quite some time and live on these networks, and their security scanning was unable to see it.
So they didn't want to spend the money?
Well, I don't know if it's they didn't want to spend the money or that the technology of the bad guy may be in some cases better than the technology of the good guy, which means that we as a, you know, as a consumer, as the businesses themselves are at a disadvantage when the bad guy has an upper hand.
Alright, for customers like me, you know, McAfee has been a product that I've used over the years to protect myself. What sort of technology exists out there for these retailers, these businesses, to protect themselves?
So the stuff they have in place is a big deal, meaning, you know, it frankly goes over the head of most consumers. You know, there's encryption, there's all kinds of firewalls. Essentially, Target really had their ducks in order. Like, they had bulletproof security.
Let me stop you right there just for 2 seconds because I've heard I've heard the exact opposite from other experts. Can you tell me— can you get a little detailed about why they had their ducks in order and it was bulletproof?
So from everything that I've read in regards to what systems Target had in place, uh, you know, they weren't fooling around. You know, they had really good security in place from what I've seen, from what I've read, from the details that have been fed to me. Uh, and I mean, it wasn't like they just, you know, left a wireless connection to the internet open and didn't update their antivirus. I mean, they actually had systems in place that go far above and beyond what any small, medium, or large business would have in place. Like, they actually, uh, made a concerted effort to protect that information, but the bad guys still found a way in. That being said, you know, the, the level of sophistication of the, uh, bad guys' technology, uh, in some cases supersedes what is available to the good guy, which again is what's concerning.
So the idea is that companies like McAfee and other security experts have to anticipate what's coming down the path before they even deal with it.
Well, that is the whole point of the security process, is to predict and to prevent, to have multiple layers of security in place so that when the bad guy gets through one layer, he doesn't get through the next layer. Mm-hmm. But in this case, again, because of the newness of this threat, one that really hasn't been seen before in the wild, so to speak, it is what made it possible.
Quick advice for consumers who've had their information compromised.
Real simple. As a consumer, you should be paying close attention to your statements. So most people, 9 out of 10, don't pay attention to their statements at all, meaning that monthly when you get that paper statement, you're not even looking at it. But you should, and you need to. In addition to that, you definitely should be checking your statements online weekly, right? Online weekly. And all of your banks and credit card companies, they provide you a mobile application for your iPhone, for your Android, so you can look at your charges every single day. You can look at every withdrawal, every transaction on your mobile. So if you're checking your Facebook page 20 times a day, why not take out one time—
Sounds like a full-time job, Robert. I'm just saying.
It's really not though. Okay. It's easy enough to check a status update or check an email. You could check an account on your mobile application.
It's good advice. Robert Siciliano, it's also good to see you. Thank you very much.
