The report concluded the card data was stolen from July through October, and it was not done by the same groups or groups that hit Target, stealing information on 70 million consumers.
Ginger Reeder, speaking for Neiman Marcus, says the hackers named their malware almost identically to the company's payment software, thus allowing over 60,000 security alerts to pass unnoticed with all the huge amounts of data sorted by the company's security.
"These 60,000 entries, which occurred over a three-and-a-half month period, would have been on average around 1 percent or less of the daily entries on these endpoint protection logs, which have tens of thousands of entries every day," Reeder added (via BW).
After the investigation, the company also found that original estimates of 1.1 million cards stolen was high, with the real figure below 350,000. 9200 of the stolen cards were used fraudulently since the attacks. Neiman Marcus concluded that it was in compliance with standards to protect transaction data, and data-security requirements were increased again this year.
All of the alerts were flagged as "suspicious behavior," but were ignored. The system's internal ability to block suspicious activity was also shut off at the time because it would have hindered the system's ability to patch other security holes and regular maintenance.
Read more about the interesting attack here.
Written by: Andre Yoskowitz @ 23 Feb 2014 19:17
