Link Found in Staples, Michaels Breaches
Summary: Sources close to the investigation say card-stealing malware was installed on cash registers at roughly 100 Staples locations, out of more than 1,800 stores nationwide, with Visa and MasterCard alerts pointing to compromised stores between July and September 2014. The same source says the Staples malware communicated with some of the same control networks used in the Michaels intrusion, which Michaels later acknowledged was two separate eight-month breaches that stole more than three million customer credit and debit cards.
What you should know: Two retail chains breached through shared criminal command-and-control infrastructure means the common link - a point-of-sale vendor, remote access path, or Windows vulnerability - is still unidentified, and any retailer still handling unencrypted card data on its network remains an attractive target.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026