Breach at Goodwill Vendor Lasted 18 Months
Summary: C&K Systems Inc., the third-party payment vendor blamed for a card breach at more than 330 Goodwill locations, disclosed that hackers had intermittent access to its systems between Feb. 10, 2013 and Aug. 14, 2014, installing a rawpos point-of-sale infostealer its security software did not detect until Sept. 5, 2014. C&K said the intrusion is known to have affected three customers including Goodwill, and that while many payment cards may have been compromised, fewer than 25 were reported used fraudulently.
Bottom line: A vendor can sit compromised for 18 months without detection, and because many state breach-notification laws are not triggered by theft of Track 2 card data alone, the two other affected organizations may never have to disclose - so the breaches you hear about are only the ones someone noticed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026