Incident
incident:retail_credit_card_breach
Also: major retail breach
Global retail-network compromise involving payment-card scraping on point-of-sale and back-of-house systems.
Global retail-network compromise involving payment-card scraping on point-of-sale and back-of-house systems.
“This is the story about a time when a major retail outlet got hacked.”
“we have evidence of a credit card breach”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Kroll | Explicit | 15 |
| outgoing | COMPROMISES | Point-of-sale registers | Explicit | 15 |
| outgoing | INVOLVES | Tiny POS | Explicit | 15 |
| outgoing | INVOLVES | lateral movement | Explicit | 15 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Uncertain | 15 |
| outgoing | INVOLVES | Backdoor | Explicit | 15 |
| outgoing | INVOLVES | IP scanner | Explicit | 15 |
| outgoing | INVOLVES | Network segmentation | Explicit | 15 |
Retail credit-card breach INVOLVES Kroll
The retail company hired Kroll to investigate possible malware in its network.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“this store wanted to investigate anyways so they called a consulting firm called Kroll”
Retail credit-card breach COMPROMISES Point-of-sale registers
The breach compromised cash-register systems used to process payment cards.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“the systems that are compromised are those particular systems”
“They’re the cash registers where you go buy something and you swipe your card”
Retail credit-card breach INVOLVES Tiny POS
The newly uncovered card-scraping malware was described as a derivative of the Tiny POS malware family.
Explicit Confidence 96% · Matt Bromiley EP 15 Details
“it’s an unknown variant but it’s a derivative of Tiny POS”
Retail credit-card breach INVOLVES lateral movement
After gaining network access, the attackers moved to other machines and propagated through the environment.
Explicit Confidence 98% · Jack Rhysider EP 15 Details
“When the hacker is in the network, they can move over to another machine to start setting up their malware.”
Retail credit-card breach INITIAL_ACCESS_VIA phishing
Matt personally believed the attackers probably entered through a phishing message, but he presented this as uncertain rather than confirmed.
Uncertain Confidence 86% · Matt Bromiley EP 15 Details
“I think personally, they came in with a phish”
“it makes me want to think it was likely a targeted approach but you never know”
Retail credit-card breach INVOLVES Backdoor
The attackers installed hundreds of back doors to preserve access to systems.
Explicit Confidence 99% · Courtney Dayter EP 15 Details
“They had added 350 back doors.”
“they were just allowing themselves access back in”
Retail credit-card breach INVOLVES IP scanner
During the attackers’ renewed activity, the team observed them running an IP scanner and logging into multiple IP addresses.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“they ran an IP scanner and then hard-coded and were able to log into all these IPs”
Retail credit-card breach INVOLVES Network segmentation
The company’s flat network and lack of segmentation enabled the malware to spread widely; network-infrastructure changes were recommended afterward.
Explicit Confidence 98% · Courtney Dayter EP 15 Details
“changing their network infrastructure so it’s not so flat”
“every system could essentially reach every other system”