It’s every retail, banking and hospitality IT department’s worst nightmare.
There’s a breach in their Point of Sale (POS) system. It’s usually discovered long after the fact, giving the hackers ample time to grab as much data as they can before they’re discovered. They end up stealing hundreds of thousands of customer credit card records, and possibly nab Social Security numbers as well, often stealing company funds in the process. This leads to embarrassing news stories featuring the IT department looking like a band of clueless rubes, and soon lots of money – usually millions of dollars – is earmarked to remediate the breach. It ends up being a huge black eye for the brand, a hideous embarrassment or worse for IT, and a major hit to customer trust along with an almost inevitable downtick in business.
A modern day corporate nightmare, in other words, played out, like a theme and variations, repeatedly across various banking, healthcare, retail and hospitality targets. Off the top of my head, I’m thinking of Target, Home Depot and Neiman Marcus in retail, with Omni, Hard Rock, Kimpton and Trump Hotels breached, often repeatedly, in hospitality, and several banks and healthcare networks also breached (and often held for ransom) in just the last few months.
But what if a breach wasn’t confined to just one company’s network? What if hackers were able to gain access to a widely distributed POS system and from there infect not only one network but more or less each network that the POS system operates in?
As you’ve probably figured out by now, this isn’t an elaborate “What If” exercise.
In 2014, Oracle purchased MICROS, a successful point of sale manufacturer with POS units (usually cash registers, or the modern equivalent) in nearly 350,000 locations worldwide across retail, restaurant and hotel locations.
Originally discovered due to an email from an anonymous inside source by Brian Krebs of KrebsOnSecurity in late July, the story has sent a shudder down the spine of anyone working with a legacy MICROS POS deployment. At first, the story seemed like it might “just” be an internal Oracle breach, but upon further investigation – still very much underway – it looks like Russian hackers, The Carbanak Gang (linked to stealing over a billion dollars through several high profile bank and retail sector breaches over the last few years), successfully breached Oracle’s network through their MICROS POS systems customer portal.
The malicious code seems to have started on one machine, and has subsequently spread, via the infected MICROS support portal itself, to over 700 legacy MICROS machines.
Seeking to quell any nascent panic among its customers, Oracle seems to be trying to minimize the impact of the incident, emphasizing that “payment card data is encrypted both at rest and in transit in the MICROS hosted customer environments.” That’s heartening, but if that’s the case, what is the Carbanak Gang doing breaching and then hanging around an impervious system. Also, Oracle is asking all MICROS customers to at least change their passwords for the MICROS online support portal. They’re nervous. And rightly so.
This is very much a breaking story, so expect to see updates in the coming days and weeks. And until more details are uncovered, be extra careful with your credit card transactions at Point of Sale systems, especially if you don’t yet have a debit or credit card with a chip in it. If you do have a chip card, use that where you can, as the double verification (chip and PIN) system will at least afford you some greater measure of security.
Or just use cash for your daily purchases for the near future!
