Forest Global Training Partners

Cyber Risks · Krebs on Security

Self-Service Food Kiosk Vendor Avanti Hacked

Summary: Avanti Markets acknowledged a breach of its internal networks in which attackers pushed malware to its self-service breakroom payment kiosks, discovered on July 4, 2017, potentially exposing customer credit card data and biometric information for the roughly 1.6 million customers who use the devices. RiskAnalytics reported that a client's kiosk was infected with the PoSeidon point-of-sale malware family and was sending data out of the network using an SSL certificate long associated with cybercrime, while a source said about half of the self-checkouts lack point-to-point encryption.

Key Takeaway: Credit cards can be re-issued, but fingerprint data cannot - and Avanti's own warning that biometric information may have been compromised suggests that data was not strongly encrypted at rest or in transit. The kiosks sat on the same internal networks as other systems, managed by third parties the victim organizations' IT staff could not easily patch, audit, or control.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related