Slashdot Mirror
Banks Report Credit Card Breach At Home Depot
criticalmass24 sends news that multiple banks are indicating Home Depot stores are the source of a new batch of stolen credit cards and debit cards that hit the black market today. "There are signs that the perpetrators of this apparent breach may be the same group of Russian and Ukrainian hackers responsible for the data breaches at Target, Sally Beauty and P.F. Chang’s, among others. The banks contacted by this reporter all purchased their customers’ cards from the same underground store – rescator[dot]cc — which on Sept. 2 moved two massive new batches of stolen cards onto the market." Home Depot is aware of the situation, and says they're investigating. The banks say this breach may have begun as early as April or May of this year and may extend to all 2,200 of Home Depot's U.S. stores.
Fuckers! Implement it like yesterday!!!
Tell you what. You want me to continue to shop at the B&M stores, then do this. Otherwise, It's Amazon for me.
Life is not for the lazy.
Instead of naming stores, how about naming the actual vendors in the headlines. You know, like IBM, NCR, etc ....?!
This will be the second time my credit card gets replaced this year.
The third time in 3 years.
I've tried to order stuff online and been forced to call in because the retailer subscribes to a service that considers me a 10/10 fraud risk.
And not because of anything I've ever done or any charges that have shown up on my bill.
[Fuck Beta]
o0t!
Why not just go to Chip and PIN...I dont seem to hear these stories in Canada or other places that use it, but I could be missing them...
The banks are reaping the rewards of years of sticking their heads in the sand on security. Europe has chip and pin which is much more secure. US credit cards are ridiculously easy to counterfeit. I hear that they are finally, slowly moving to chip and pin since their losses to fraud are increasing.
I don't read your sig. Why are you reading mine?
.. its a direct result of technical mono-culture. Diversity in security technology is the way forward.
They work cheap.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Of course, if we pay with cash then it would be assumed we have something to hide.
I am suddenly grateful we've been using a store branded Home Depot credit card for the last few years. Replacing that with a new one won't be painful at all. I think I've paid cash if the amount was under $10, too.
Still going to go through ye old checking account and verify there's no HD charges on there since April.
Occasionally living proof of the Ballmer peak.
I hear that they are finally, slowly moving to chip and pin since their losses to fraud are increasing.
One of my recently replaced cards is chip and signature, and I think that's what most US-issued smart cards are using. Security-wise, it's kind of a half measure, but at least it's a step forward from complete reliance on the magstripe.
It is pitch black. You are likely to be eaten by a grue.
You know, I think it's true that Europe had a much higher rate of fraud, which convinced them to move to chip&pin sooner.
Yes, I've heard that they're working to move to chip&pin, my bank sent out a notice that they're working on it. When I get closer to the expiration of my card I might call them up and ask to be moved over as I actually travel internationally occasionally and it'd be nice to be able to use my card in European stores.
I don't read AC A human right
If you don't want your credit card number stolen and displayed all over the Internet, you shouldn't use your credit card! What were these people thinking?!?!
And with that moral justification out of the way, let me go Google for those Jenni.... er credit card photos.
Not any time soon - as it happens, I have an Amazon card from Chase and just got the replacement for an expiring card - no chip and pin, I called and asked about it and they sid they MAY have it when my next card comes in 3 years...so dont hold your breath.
I mention Amazon specifically because other commenters seem to think that anything Amazon is immune and safe...not so fast young grasshopper...
One for the card present transactions and one for other phone transactions?
This would at least lower the value of the card present card numbers because the carders would have to physically be present to win.
How hard is it to run an independent circuit that scrapes your OS and process executable memory and compute a verified hash? Do these systems run any kind of meaningful IDS at all?
Yeah, yeah, yeah, I get that.
But here on Slashdot - NAME the vendors. OK?
When I check out - and I have worked in this industry and I won't name who i developed software but I can say we NEVER considered these threats - ever - I look at the checkout hardware.
Me
I am a GEEK and a NERD - like Slashdot NERDS.
Get it?!
I was just a code monkey but I may be part of this. mKAY?!
Why do these mega corporations keep storing credit card information insecurely? Are they required by law to be stupid?
It's so good to see enemies working together this way. Hacking for peace!
Nope, they will issue a new card with at least chip and signature by next fall, October 2015 is the deadline from Visa for the card providers to move over as well as the merchants. After that date if the card issuer has issued a chip card and the merchant uses the magstripe then the merchant is liable for the fraud, there is no way in hell any card issuer is going to give up that kind of liability offload for one moment, let alone 2 years. The idiot bots that answer the phone have no idea what's actually going on, but I can all but guarantee you that you will be getting a new card around this time next year with a chip.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
What the hell is so bad about RU and UA killing each other off?
Give us real security - a Token based system that generates a new single use credit card number for each and every purchase made using the card - both on and off line.
That number should only be reusable if you want to make it a reoccurring, monthly charge.
excitingthingstodo.blogspot.com
The real problem with using signatures is that the banks don't require any actual matching to be done on signatuers to see if they are valid. Any squiggly, X, or line is accepted just as easily as a real signature.
Chip and signature may not help against physical theft of the card, but it will put a stop to these massive breaches by hackers.
I am going to start using cash a lot more often until the system has it's act together. All of the crooks are busy robbing people the 21st century way anyhow. The good news is that between this and the NSA's shenanigans, security development efforts are on fire right now. It's long overdue.
And where does Microsoft Windows come into the equation?
We desperately need more talented people in IT. This would never happen if local workers were replaced with overseas talent.
Thank you Mister Gates, Buffet and Adelson for pursuing what is right for this country.
Yeah;-
Bitcoin Bitcoin Bitcoin Bitcoin
Just saying...
... back to the days of the credit card imprinter.
Then back to fax machines and snail mail.
Yes, these all have holes, but we know what they are and we know how to deal with them and foreigners would have the dickens of a time exploiting them and stuff.
It little behooves the best of us to comment on the rest of us.
More to the point, the merchant is prohibited from declining any payment via credit card that has been approved by the terminal regardless of whether the signature matches. Further, they cannot request ID as part of the checkout---per their payment processing agreement.
Home Depot stores credit cards with the transactions.
I know this because when you go to return something I bought, they don't ask you for the credit card, and sort of highlight that this is a convenience that is unique to Home Depot.
I complained more than once to the cashiers about storing credit card numbers (it is not their fault, it is management and IT). The cashiers would say: "Don't worry, we don't have access to it!"
My response was: it is not you whom I am worried about.
Now we know that storing credit cards is a bad idea, and why ...
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
As a merchant who accepts credit cards, a few years back they came up with PCI Compliance. First you had to show some very basic data security. Then, they tried to sell you insurance. Then, they required you to take the data security insurance. If you are "PCI noncompliant" then you get tagged $20.00 per month. I appreciate how they made this too into an opportunity to gouge the small merchant, to no effect at the high end.
Some of the stupidest ppl elsewhere and here screamed that target was caused by having an HVAC key. So, I guess that HVAC everywhere is making it possible to break into these systems?
Or is is far more likely that all of them using Windows, combined with using off-shore admin/coding, specifically India where the 60 rupees to $1 means that their engineers are making less than $10K / year, the far more likely route?
My bet is that the idiots, combined with those who are doing the bribes, continue to push the idea that it was an American inside job.
I prefer the "u" in honour as it seems to be missing these days.
The 'investigators' are performing cross-referencing of Barry Obama, Barak Obama, Barak Hussein Obama and Barak Hussein Obama II credit/debit cards and issuing Banks in U.S.A., Europe, Africa and Asia.
Old Boy Barak can't win this.
He must abdicate the Presidency or face ignominious impeachment, trial and imprisonment.
Even Barak's beloved bong cannot save him.
Tough tittie old boy barak.
You do not need to store CC number to roll back transaction - you only need transaction or auth number.
I've always assumed that they stored only the hashes of the CC number. In any case they (probably) don't store the expiration date
The local Home Depot also ties CC #'s to your email, allowing you to receive copies of your receipts in email. This is very useful if you need to keep receipts for tax purposes. However, if they're tying this to the plain-text CC info, not good at all (I had assumed some modicum of intelligence and that the emails were tied to name+hash).
What could possibly go wrong?