Deconstructing the 2014 Sally Beauty Breach
Summary: A former Sally Beauty application support analyst said attackers used a district manager's login credentials, found taped to his laptop, to enter a Citrix remote access portal and then mapped the corporate network. The intruders located a Visual Basic script containing a network administrator's username and password, then used a batch file loop to copy card-stealing malware to roughly 6,000 point-of-sale registers after about a week of planning.
What's compelling: Krebs reported 260,000 cards for sale on Rescator[dot]cc, while the company said only 25,000 were taken and the former technician estimated the true figure was closer to a million based on daily transaction volume. The malware sent stolen card data out as DNS traffic to domains hosted in Ukraine, and the same shop that sold cards from the Home Depot and Target breaches listed these by store ZIP code.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026