Parking garage operator hacked by POS malware
Posted by: Timothy Weaver on 12/02/2014 10:34 AM
[
Comments
]
SP+, a major US parking garage operator, has announced that it was hacked by the POS malware.
The company made this statement:
On November 3, 2014, SP+, a professional parking facility service provider, received a notice from the company that provides and maintains the payment card systems in some of its parking facilities that an unauthorized person used that company’s remote access tool to connect to computers that process payment cards in a limited number of those facilities. Upon learning this, SP+ immediately launched an investigation and engaged a leading computer forensic firm to examine the payment systems in the parking facilities.
The unauthorized person used the remote access tool to install malware that searched for payment card data that was being routed through the computers that accept payments made at the parking facilities. While SP+ was conducting this investigation, it identified one additional facility where card data was at risk. The information from payment cards that may have been captured by the malware is the cardholders name, card number, expiration date, and verification code.
This incident affected 17 SP+ parking facilities. Though SP+ does not have sufficient information to identify whether any specific cards were taken or to mail notification letters to the potentially affected cardholders, SP+ wanted to let its customers know about this incident as soon as it could.
Steve Hultquist, chief evangelist at network visibility vendor RedSeal, said: “[The] announcement by parking garage operator SP+ should warn every organization that accepts credit card payments that they are an active target.”
The company made this statement:
On November 3, 2014, SP+, a professional parking facility service provider, received a notice from the company that provides and maintains the payment card systems in some of its parking facilities that an unauthorized person used that company’s remote access tool to connect to computers that process payment cards in a limited number of those facilities. Upon learning this, SP+ immediately launched an investigation and engaged a leading computer forensic firm to examine the payment systems in the parking facilities.
The unauthorized person used the remote access tool to install malware that searched for payment card data that was being routed through the computers that accept payments made at the parking facilities. While SP+ was conducting this investigation, it identified one additional facility where card data was at risk. The information from payment cards that may have been captured by the malware is the cardholders name, card number, expiration date, and verification code.
This incident affected 17 SP+ parking facilities. Though SP+ does not have sufficient information to identify whether any specific cards were taken or to mail notification letters to the potentially affected cardholders, SP+ wanted to let its customers know about this incident as soon as it could.
Steve Hultquist, chief evangelist at network visibility vendor RedSeal, said: “[The] announcement by parking garage operator SP+ should warn every organization that accepts credit card payments that they are an active target.”
Comments
