And yet again, an American retailer and its customers go down the road of data theft. In this case, the retailer is Advance Auto Parts and the most recent hack affected 56,000 of its shoppers in eight states - Georgia, Indiana, Louisiana, Mississippi, New York, Ohio, Tennessee and Virginia. Luckily, the customers from the stores in question represent a small portion of the total shoppers that frequent the chain's 3,261 stores across the country.
The discovery of the breach, as with those at other retailers, has prompted Advance to reassess its security measures. Others, at the same time, are once again questioning if Payment Card Industry (PCI) compliance standards are either fair or effective.
In a recent interview with RIS News, Dave Hogan, senior vice president and chief information officer with the National Retail Federation (NRF), expressed the view that more secure forms of payment such as "Chip & Pin" were available and proven in reducing fraud. He suggested that card associations should "provide (at no cost to the merchant) card readers that can accept these new types of cards."
Branden Williams, director of PCI practice for VeriSign Global Security Consulting, took issue with Mr. Hogan's position. Regarding "Chip & Pin," Mr. Williams told RIS News it “slows down the bad guys, but does not stop them. Besides, there is an issue with Chip & Pin in the United States - acceptance! What good is a reader if no one carries the card to use them? I seriously doubt that the card associations would pay for the terminals. Even if they did, retailers will likely have to do major alterations to their software to be able to handle both types of transactions in parallel. How about we just spend a little bit of time securing the data in flight?"
Mr. Hogan also took issue with the amount of data that merchants are required to keep by banks. He called on financial institutions to "state that 'Retailers have the option to no longer store credit card data and they will not be penalized for not keeping credit card data.'"
Discussion Questions: Are Dave Hogan's criticism of the PCI system valid? Should the industry be moving to an alternate transaction form such as "Chip & Pin" used in Europe? Are banks requiring retailers to hold onto reams of data that are unnecessary and costly to both the merchant and consumer?
- Advance Auto Parts Releases Information Regarding Network Intrusion Potentially Impacting 14 Stores and up to 56,000 Customers - Advance Auto Parts, Inc./Business Wire
- New Security Breach Highlights Need for Innovative Strategies in Post-PCI Era - RIS News
- PCI May Never Stop Hackers: Time to Rethink Security - RIS News
- The NRF Goes Past Where the Sidewalk End - Branden Williams' Security Convergence Blog