Hackers breach Saks, Lord & Taylor customer data, parent Hudson’s Bay says

NEW YORK – AP

A data breach at department store chains Saks Fifth Avenue, Saks Off Fifth and Lord & Taylor has compromised the personal information of customers who shopped at the stores.

The chains’ parent company, Canada-based Hudson’s Bay Co., announced the breach of its store payment systems on Sunday. The company said it was investigating and taking steps to contain the attack.

The disclosure came after New York-based security firm Gemini Advisory LLC revealed on Sunday that a hacking group known as JokerStash or Fin7 began trying to sell a stash of up to 5 million stolen credit and debit cards on dark websites last week. The security firm confirmed with several banks that many of the compromised records came from Saks and Lord & Taylor customers.

Hudson’s Bay said in a statement that it “deeply regrets any inconvenience or concern this may cause,” but it hasn’t said how many Saks or Lord & Taylor stores or customers were affected. The company said there’s no indication that the breach affected its online shopping websites or other brands, including the Home Outfitters chain or Hudson’s Bay stores in Canada.

The company says customers won’t be liable for fraudulent charges. It plans to offer free credit monitoring and other identity protection services.

There is evidence that the breach began about a year ago, said Dmitry Chorine, Gemini Advisory’s co-founder and chief technology officer. He said the prolific hacking group has previously targeted major hotel and restaurant chains.

Chorine said the hackers’ method is to send cleverly crafted phishing emails to company employees, especially managers, supervisors and other key decision-makers. Once an employee clicks on attachment, which is often made to look like an invoice, the system gets infected.

“For an entire year, criminals were able to sit on the network of Lord & Taylor and Saks and steal data,” he said.

Chorine said most of the stolen credit cards appear to have been obtained from stores in the New York City metropolitan area and other Northeast U.S. states. It’s possible, he said, that those stores hadn’t yet adopted the more secure credit card payment systems that have been rolled out elsewhere.

LATEST BUSINESS STORIES

Department stores' July sales see largest drop in more than three years

Department stores posted the largest year-on-year drop in sales in more than three years in July, as unfavorable weather conditions kept customers away and clothing sales slumped, an industry bo...

Mobile phone operators take ¥1 trillion blow after Suga says bills could be cut 40%

Wireless carriers tumbled in Tokyo after the government's spokesman said they have room to cut phone bills by about 40 percent, sparking concern that lawmakers will renew a push for greater comp...

Nikkei rebounds on strong China stocks, halt to yen rise

The benchmark Nikkei average edged up on the Tokyo Stock Exchange on Tuesday, helped by brisk Chinese stocks and a halt to the yen's strengthening against the dollar. The 225-issue Nikke...