Over Easter weekend, hackers stole 5 million credit and debit card numbers that were used at Saks Fifth Avenue, Saks Off Fifth, Lord & Taylor, and Canada-based Hudson’s Bay Company. The personal information of customers who shopped at these stores is now compromised.
Most of the stolen card data — which goes all the way back to May 17 — was obtained from these stores in the New York City metro area, and other stores in the Northeast U.S. It appears that these stores weren’t using a secure credit card payment system. Security firm Gemini Advisory reported:
“The attack is amongst the biggest and most damaging to ever hit retail companies...Credit card data was obtained for sales dating back to May 2017. The breach likely impacted more than 130 Saks and Lord & Taylor locations across the country, but the majority of stolen credit cards were obtained from New York and New Jersey locations.”
Gemini Advisory says that the hacking group JokerStash/Fin7 boasted about their success on the Dark Web and that the data is now for sale. The name of their “product” is BIGBADABOOM-2. Gemini Advisory’s co-founder and chief technology officer said that this group previously targeted major hotel and restaurant chains. They were also responsible for other data breaches like the ones that affected companies including Whole Foods, Chipotle, Omni Hotels & Resorts and Trump Hotels.
The hackers typically use phishing emails to gain confidential information. They send the emails to company employees including managers and supervisors who are key decision makers. They disguise themselves as an entity these people would recognize as legitimate. The email contains an invoice and asks them to pay it via a link provided. Once clicked, their IT system is infected.
No store is immune from this type of breach. However, you can protect your business from phishing attacks by educating your employees.
Cybersecurity training is a must for all businesses today. You can have all the right security technology in place, but if one of your employees unknowingly clicks a malicious link, or visits a counterfeit website, your business can be ruined.
Phishing is when a scammer uses fraudulent emails, texts, or copycat websites to get you to click a link so that they can steal your confidential information like Social Security numbers, account numbers, login IDs, and passwords. They use this information to rob you of your money and your identity.
The majority of account takeovers come from simple phishing attacks where you or someone in your organization gets tricked into releasing private credentials and information.
Scammers also use phishing emails to get access to your computer or network, so they can install programs like ransomware that lock you out of your important files unless you pay a ransom.
Spoofing
Phishing scammers try to lure you or your employees into a false sense of security by pretending to be a trusted source like a legitimate company, the IRS, a colleague, vendor, or even a friend or family member.
Phishers create a sense of urgency, making it seem like they require your information right away or something terrible will happen to you. They may threaten to hold back a tax refund or close your bank account. Essentially, they lie to get your information.
Here are things that you and your employees should do to protect your business.
Be cautious about opening attachments and clicking links in emails.
Files and links may contain malware that can infect and weaken your computer’s security.
Type in URLs and email addresses.
If a company or organization you know sends you a link or phone number, don’t click the link or call the number. Go to your search engine and type in the correct URL for the company’s site and find the legitimate phone number.
Call the source. Don’t respond to emails that request confidential or financial information. Phishers use strategies that prey on fear. If you think the contact in the email needs this information, refer to the phone number in your address book, not the one posted in the email, and call them to verify the request.
Use Two–Factor Authentication. For accounts that support this, two-factor authentication is an extra step to ensure the security of your information. It requires both your password and an additional piece of information to log in to your account. The second piece might be a code the company sends to your phone or a random number generated by an application or token. Two-factor authentication protects your account even if your password is compromised.
Update your applications and Operating System. Use a good security software you trust, and make sure you set it to update automatically. Also, make sure you update all your applications and your Operating System when you receive patches from the manufacturer. Don’t delay, as there are good reasons for these updates, and they will protect your information from the latest threats.
Back up your files to an external hard drive and enterprise-based cloud storage. Back up your files regularly to ensure you have a duplicate of all your files and applications if your network is compromised.
Google conducted a study between March 2016 and March 2017 in conjunction with researchers from the University of California, Berkeley. The results revealed that phishing is far riskier for users than data breaches because of the additional information phishers collect.
Use a unique email address.
Spammers send out millions of messages to name combinations hoping to find a valid email address. If you use a common name like Joe, you’ll receive more spam than with a name like Wwmj4itvi. It’s harder to remember an unusual name like this. Try using an acronym like: “We were married June 4 in the Virgin Isles (Wwmj4itvi).
Use an email filter.
If your email account provides a solution that filters out potential spam or will channel it into a bulk email folder, opt for this. If they don’t, you might want to consider another Internet Service Provider.
Use more than one email address.
Consider using a disposable email address service that forwards messages to your permanent account. If the disposable address receives a lot of spam, you can shut it off without affecting your permanent address.
Limit your exposure.
Don’t share your email address in public. This includes blog posts, chat rooms, social networking sites, or in online membership directories. Spammers use the web to obtain email addresses.
Check privacy policies and uncheck boxes.
Before submitting your email address to a website, determine if they can sell your email to others. Don’t provide your address to sites that won’t protect it.
Be wary of messages that:
- Try to solicit your curiosity or trust.
- Contain a link that you must “check out now”.
- Contain a downloadable file like a photo, music, document or pdf.
Don’t believe messages that contain an urgent call to action:
- With an immediate need to address a problem that requires you to verify information.
- Urgently asks for your help.
- Asks you to donate to a charitable cause.
- Indicates you are a “Winner” in a lottery or other contest, or that you’ve inherited money from a deceased relative.
Watch for messages that:
- Respond to a question you never asked.
- Create distrust.
- Try to start a conflict.
Watch for flags like:
- Misspellings
- Typos
Always Use Secure Passwords.
- Use Two-Factor Authentication if it’s available.
- Never use words found in the dictionary or your family name.
- Never reuse passwords across your various accounts.
- Consider using a Password Manager (e.g., LastPass or 1Password).
- Use complex passwords.
- Create a unique password for work.
- Change passwords on at least a quarterly basis.
- Use passwords with 9+ characters.
Keep Your Passwords Secure.
- Don’t tell anyone your passwords.
- Don’t write them down or email them.
- Never include a password in a non-encrypted stored document.
- Don’t speak your password over the phone.
- Don’t hint at the format of your password.
- Don’t use “Remember Password” feature of application programs such as Internet Explorer, Portfolio Center or others.
- Don’t use your corporate or network password on an account over the Internet that doesn’t have a secure login starting with https://. If the web address begins with https:// your computer is talking to the website in a secure code that no one can access. There should be a small lock next to the address. If not, don’t type in your password.
If you believe your password may have been compromised, you should change it.
Regularly Backup Your Data Both Onsite and Remotely.
- Maintain at least three copies of everything.
- Store all data on at least two types of media.
- Keep a copy of your data in an alternate location.
If you haven’t backed up your data and you’re attacked, it’s gone forever.
Ask Your IT support to Conduct Testing and Security Awareness Training for Your Employees.
- Give a social engineering test.
- Share the results with your staff.
- Debrief and train your users.
- Test again each year.
Report Phishing Emails and Texts to the Federal Trade Commission.
Forward phishing emails to the Federal Trade Commission at spam@uce.gov – as well as the organization that was impersonated in the phishing email. Include the full email header if it’s available.
File a report with the Federal Trade Commission at FTC.gov/complaint.
Visit Identitytheft.gov. Victims of phishing could become victims of identity theft; there are steps you can take to minimize your risk.
You can also report phishing emails to reportphishing@apwg.org. The Anti-Phishing Working Group which includes Internet Service Providers, security vendors, financial institutions and law enforcement agencies uses these reports to fight phishing.