Food retail group, Musgrave has confirmed that it has been the subject of a cyberattack.
In a statement, the company said that its SuperValue, Centra and Daybreak stores have been affected and incident is the subject of “an ongoing investigation” with An Garda Síochána.
The statement said that the Office of the Data Protection Commissioner has been informed of the incident, and Musgrave said it “will keep it updated regularly”.
The company said it had detected malicious software attempting to extract debit and credit card numbers and expiry dates, but not the cardholder name, PIN number or CCV number.
“While there is no evidence that any data has been stolen at this point,” said the statement, “Musgrave is advising any concerned shoppers to review activity on their statements as a precautionary measure.”
The company said that its “cyber breach response experts” have installed “advanced technical fixes” and continue to actively manage and monitor the situation. No detail was provided on what the “advanced technical fixes” might be.
The statement concluded, “The protection of information is an absolute priority for Musgrave, with a range of security solutions including threat-monitoring, anti-virus software, firewall and penetration testing deployed. The company aims to ensure that security standards are maintained at the highest levels and apologises to its customers for this issue.”
Brian Honan, security expert and founder of BH Consulting, commended Musgrave for involving the Gardaí and the ODPC at an early stage, adding that it will help protect any affected customers and may enable law enforcement to find who is behind the attack.
Honan said it will be a key issue to determine what kind of malware was used and whether it targeted Musgrave’s computer systems or Point Of Sale (PoS) networks.
This information will be valuable to other organisations so they can take necessary steps to protect themselves, said Honan.
Paul C Dwyer, CEO of Cyber Risk International and the chairperson of the International Cyber Threat Task Force, said that retailers are a particular target for cybercriminals.
Retailers’ data is gold for cyber criminals, said Dwyer, there is always a market for it as it can be used as part of other scams. Entry points for such attacks, he said, can be the likes of point of sale devices, customer facing ecommerce sites, links through third-party vendors, partners or suppliers, or employee-facing access points.
The complex supply chains, typical of today’s multi-faceted retailers, can also be a source of cyber-issues, said Dwyer.
He warned that Musgrave investigators should watch out for what he termed “digital grenades” as they try to secure the networks, as cybercriminals often leave such things to either cover their tracks or to inflict malicious damage in their wake.
In 2013, Musgrave’s SuperValu chain was the subject of a data breach when its “Getawaybreaks” scheme, run by LoyaltyBuild, was compromised. Some 38,000 customers were notified in an incident that was localised to that single scheme.
TechCentral Reporters
Ltd
