Another US store, Rutters has made it to the news due to a POS malware attack. Reportedly, Rutter’s suffered a security breach at multiple locations as the malware pilfered customers’ payment card data.
Rutters Disclosed POS Malware Attack
The US-based chain of stores Rutters has recently disclosed a wave of POS malware attack that it suffered. Sharing the details in a security notice, Rutter’s revealed that the incident may have affected customers’ payment card data.
As elaborated, Rutter’s came to know of the incident from a third-party report, following which, they began investigating the matter. Digging further unveiled evidence of unauthorized access to their point-of-sale terminals.
On January 14, 2020, the investigation identified evidence indicating that an unauthorized actor may have accessed payment card data from cards used on point-of-sale (POS) devices at some fuel pumps and inside some of our convenience stores through malware installed on the payment processing systems.
The malware then scanned the cards used in transactions to pilfer cardholder names, card number, date of expiry, and internal verification code. However, for EMV cards scanned on EMV POS devices, the malware could only access the card number and expiration date.
The attack continued to exist on the POS systems for about seven months, that is, from October 1, 2018, to May 29, 2019. Yet, it persisted in a varying manner at various locations during this time period.
What Next?
Rutter’s, after noticing the breach, started investigations over the matter whilst involving relevant cybersecurity firms. They also informed law enforcement authorities regarding the breach.
The malware has been removed, and we have implemented enhanced security measures. We also continue to work to evaluate additional ways to enhance the security of payment card data. In addition, we continue to support law enforcement’s investigation.
While they have publicly disclosed the incident, they have also shared the details about the locations affected during the incident and the duration of the attack. Users can visit this link to see the list of affected locations.
The firm also advised users to vigilantly monitor their transactions for any unauthorized activity.
Earlier, another US venture, Landry, also disclosed a breach following a POS malware attack that also lasted for seven months.
Let us know your thoughts in the comments.