Michaels Stores Investigates Data Breach

Arts-and-crafts retailer goes into damage-control mode after banks report fraud possibly tied to shoppers credit cards.

Top 10 Retail CIO Priorities for 2014 (Click image for larger view and slideshow.)
Arts-and-crafts retailer Michaels Stores is the latest business to confirm that its investigating an apparent hack attack against its systems resulting in the theft of shoppers credit and debit card details.
We recently learned of possible fraudulent activity on some US payment cards that had been used at Michaels, suggesting we may have experienced a data security attack,
said Michaels CEO Chuck Rubin
in a statement Friday.
Although the investigation is ongoing, based on the information we have received and in light of the widely reported criminal efforts to penetrate the data systems of US retailers, we believe it is appropriate to notify our customers that a potential issue may have occurred, he added. The company also posted a link to the statement -- Important Notice About Certain Customer Payment Card Information -- at the top of its
websites homepage
.
Michaels statement came just hours after security journalist
Brian Krebs first reported
that multiple sources in the banking industry said elevated levels of fraud were traced to the accounts of people who shopped at the retailer.
[Are retailers trying to shift the blame? See why one commentator says
Target Mocks, Not Helps, Its Data Breach Victims
.]
So far, however, Michaels has yet to offer any breach-related details, such as attack timing or the number of cards that may have been compromised. But the retailer did say Friday that its brought in third-party digital forensic investigators, continues to work with law enforcement agencies, will offer regular updates about the investigation on the Michaels website, and will extend ID theft monitoring to anyone who was affected. If we find as part of our investigation that any of our customers were affected, we will offer identity protection and credit monitoring services to them at no cost, Rubin said.
Michaels operates more than 1,250 stores in the United States and Canada -- some under the Aaron Brothers name -- and appears to have quickly gone into damage-control mode. Notably, the retailer Saturday began offering a seven-day 40% off any one regular price item promotion. That fast response could relate to the companys plans to go public this year. According to a related document filed in December with the Securities and Exchange Commission, the retailer
booked $4.4 billion in 2012 revenue
.
The apparent Michaels breach suggests that the retailer is the latest victim of hackers wielding
memory-scraping
point-of-sale (POS) malware. Previous victims have included Target, Neiman Marcus, and a handful of other retailers that have yet to disclose that they were breached.
How bad have those breaches been? For starters, the
Target breach
resulted in the theft of 40 million credit and debit cards used by shoppers in Targets retail stores, as well as personal information on 70 million Target customers. Meanwhile, Neiman Marcus disclosed Thursday that
1.1 million credit and debit cards
-- though not PIN codes -- were compromised by hackers during a three-month attack. Those cards were all used by shoppers in its Neiman Marcus and Last Call stores. To date, Discover, MasterCard, and Visa have reported seeing about 2,400 of the stolen payment cards being used for fraudulent purchases.
In the past 10 months, US-CERT, which is part of the Department of Homeland Security, has
published three security advisories
warning retailers about the increasing threat of POS-malware attacks, as well as how to protect themselves.
In other data breach news, Coca-Cola disclosed Friday that a laptop stolen by a former employee contained personal information -- including social security and drivers license numbers -- on 74,000 current and former employees in North America, including information on about 4,500 contractors and vendors.
Unlike the breaches at Target and Neiman Marcus, however, Coke said its data breach occurred after a former employee stole 55 company laptops over a six-year period. Coke said it recovered the laptops in November and December and began reviewing the 200,000 files collectively stored on the machines for signs of personal information.
Coke found that the exposed personal information had been stored on the laptops in unencrypted form, thus in violation of Cokes data-encryption security policies. The company
told The Wall Street Journal
that it notified people who were affected by the breach within 45 days, which is the time limit set by states with the most stringent data breach laws.
Mathew Schwartz
is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.
Having a wealth of data is a good thing -- if you can make sense of it. Most companies are challenged with aggregating and analyzing the plethora of data being generated by their security applications and devices. This Dark Reading report,
How Existing Security Data Can Help ID Potential Attacks
, recommends how to effectively leverage security data in order to make informed decisions and spot areas of vulnerability. (Free registration required.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Michaels Stores Investigates Data Breach