Forest Global Training Partners

Cyber Risks · Krebs on Security

Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards

Summary: A carding site called Joker's Stash listed more than 5.3 million stolen credit and debit card accounts from 35 U.S. states for sale under the code name "Solar Energy," and sources told KrebsOnSecurity the data came from compromised gas pumps, coffee shops and restaurants operated by Hy-Vee, an Iowa-based chain of more than 245 supermarkets. Hy-Vee said on Aug. 14 it was investigating a breach of payment systems at those locations, which it said use different point-of-sale systems than its grocery checkout lanes, pharmacies and convenience stores that rely on point-to-point encryption.

Why it matters: The stolen card records, known as dumps, were priced at $17 to $35 each, and the breach was tied to point-of-sale systems outside the encrypted checkout lanes - a reminder that a merchant's weakest payment path, not its best-protected one, sets the exposure.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related