Unencrypted Retail POS System Cited in Forever 21 Breach

Clothing retailer Forever 21 suffered a POS system breach in an undisclosed number of stores from March to October 2017, the company announced last week. The Forever 21 breach was discovered by a third party and involved hackers taking advantage of POS systems that were not encrypted. There are two primary lessons to be learned from the Forever 21 breach. First, PCI DSS compliance is critical for anyone who accepts or processes payment cards, and second, no organization, retail or otherwise, can afford to let its guard down during the winter holiday season. PCI DSS Compliance Still Lacking; Automation Can Help Compliance with PCI DSS is mandatory for any organization that accepts, processes, or stores payment cards from the major credit card brands. Penalties for violating PCI DSS are severe. The credit card companies that mandate PCI DSS could impose fines amounting to tens or even hundreds of thousands of dollars, and if a company is unable to pay the fines, they will no longer be able to accept those cards. Organizations that violate PCI DSS could also run afoul of state data privacy laws, many of which mirror PCI DSS requirements. Then, there are the direct and indirect costs of responding to the breach, including defending civil lawsuits brought by angry consumers. Violating PCI DSS simply isn’t worth the risk. Yet, according to the Verizon 2017 Payment Security Report, only a little over half of assessed businesses (55.4%) were in full compliance with PCI DSS. While this has nudged up a bit from 2015, when only 48.4% were compliant, this means that nearly half of all organizations that take credit cards are violating PCI DSS. Further, Verizon reports that out of the nearly 300 payment card breaches it investigated between 2010 and 2016, not a single organization was in full compliance at the time of the breach. The takeaway here is that while compliance with PCI DSS does not guarantee that a company’s POS systems will not be breached, compliance is the foundation of proactive cyber security. Without it, everything else crumbles. While the Forever 21 breach is still under investigation, the fact that some of the chain’s stores were not encrypting cardholder data hints at PCI DSS violations. It should be noted that only some of Forever 21’s stores were impacted. Large retail chains often struggle with maintaining PCI DSS compliance at all locations, especially if they are not employing GRC software solutions to automate the process. Retail data environments are highly complex and involve multiple systems at dozens, hundreds, or even thousands of locations, from HR and payroll systems to in-store POS terminals to ecommerce sites. GRC software automates the compliance process and integrates IT governance, policy management, risk management, compliance management, audit management, and incident management across the enterprise. This ties together all of a retailer’s networks and systems and prevents situations like the Forever 21 breach, where some stores’ POS systems were secured, but others got left behind. Hackers Don’t Take Holidays The Forever 21 breach was disclosed near the beginning of this year’s holiday shopping season, when consumers flood brick-and-mortar stores and ecommerce sites, and cyber criminals looking to steal payment card information tend to up their game. However, just because your company doesn’t operate in the retail industry doesn’t mean you can be lax about cyber security betwee Thanksgiving and the New Year. The NotPetya attacks that struck Ukraine last summer were timed to take advantage of a national holiday in that country, when hackers knew that many businesses would be short-staffed and not paying as much attention as they should. Cyber criminals know that many businesses in the U.S., caught up in holiday celebrations, dealing with staff vacations, and possibly operating on limited hours, let down their guard during the winter holiday season. On New Year’s Eve last year, Los Angeles Valley College was hit by a massive ransomware attack that disabled all of its systems; the school ended up paying a ransom of more than $28,000 to get back in. Not only could your company be hacked during the holidays, but hackers may be even more likely to attempt to strike right now, when they think you’re not looking. Enjoy the holidays, but don’t let cyber criminals spoil the eggnog; keep adhering to the same proactive cyber security measures you practice the rest of the year.