Almost 99,000 Credit Cards Compromised In Data Theft In “Forever 21″ Retail Stores
Payment cards used by customers of several Forever 21 Inc. retail stores may have been compromised in a series of data thefts dating back to August 2004. Forever 21, a discount retailer company based in Los Angeles, have been notified by the U.S. Department of Justice in Boston on Aug. 5. There was no explanation for why the company waited more than a month after it discovered the compromise to notify affected customers about it. Forever 21 discovered the thefts only after being notified of them by the Department of Justice, according to a statement released last week and posted on the discount retailer’s Web site.
The Department of Justice (DOJ) last month filed indictments against three people who allegedly hacked into computer systems belonging to 12 retailers to steal payment card data, including a much-publicized breach at TJX Companies. Forever 21 said it was notified by the DOJ that it was one of the victims of those attacks and was given a disk containing “potentially compromised file data.”
A subsequent forensic analysis revealed that transaction data for approximately 98,930 credit and debit card numbers had been illegally accessed, with more than 20,000 of the transactions made at the company’s Fresno store. The company’s investigations indicated that the intrusions affected customers who shopped at the company’s stores on nine specific dates. The first intrusion dated back to March 25, 2004, the most recent one occurred Aug. 14, 2007.
The compromised data included credit and debit cards, expiration dates “and other card data,” but did not include customer names or addresses. More than half of the compromised payment cards are either inactive or have expired, the company said. The company offered no details on what other data might have been compromised, and it was not clear whether all nine of the data theft incidents resulted from a single intrusion or whether the company’s systems were broken into nine separate times.
Forever 21 stressed that it has complied with the requirements of the credit card industry’s Payment Card Industry Data Security Standards (PCI DSS) since they went into effect. And it noted it has been certified as being PCI-compliant since 2007. It was not immediately clear whether that compliance was achieved before or after August 2007, when four of the illegal data access incidents took place.
The incidents cited by Forever 21 appear linked to the early August arrests of 11 people on credit card fraud-related charges. They are believed responsible for a series of data heists at 12 major retailers, including TJX Companies Inc., Forever 21, BJ Wholesale Clubs Inc, DSW Inc. Office Max Inc., Barnes and Noble and Sports Authority.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.