Where have all the hackers gone?


Through a special arrangement, what follows is an excerpt of an article from FierceRetail, an e-newsletter and website covering the latest retail technology news and analysis.
It’s been awhile since the last major data breach. Have the hackers moved on from retail or is this a calm before another storm? Probably both and neither.
There are a limited number of really accomplished cybercriminals out there. And as retailers have tightened their technological defenses, these bad guys have moved on to easier and perhaps more lucrative pickings.
Has all the talk about tokenization, PCI DSS standards compliance, point-to-point encryption, EMV chip cards, Apple Pay, Bitcoin and better awareness of malware scared them off? Not likely. While going after softer targets, they are also no doubt preparing a new round of attacks.
For instance, a recent study said that as the transition to EMV chip cards gets established, the bad guys will turn their attention from in-store POS systems to card-not-present online transactions.
Or take this metaphorical example: Your house gets robbed, so you get a dog. The next time that robber bypasses your house and breaks into a neighbor’s house where there is no dog, that neighbor gets a bigger and meaner dog than yours, and the cycle starts over.
Is there an end to this cybersecurity arms race? No, at least not in the foreseeable future. It’s the cost of staying in business in 2015.
Retailers will need all of the above-mentioned technologies, blended together by someone who knows what they are doing and what cybercriminals are up to. "Though tokenization and EMV have a place, there is no silver bullet. Retailers must consider and assess the security along all points in their processing," said Wolfgang Goerlich, a cybersecurity strategist at CBI.
Two deadlines on the horizon should help retailers set priorities.
The June 30 compliance deadline for five mandatory changes accompanying Payment Card Industry Data Security Standard version 3.0 is a response to the methods and tactics of card data thieves. Retailers who experience a data breach and haven’t met the requirements will face heavy fines.
The other is the fraud liability shift deadline for EMV chip cards in October. That is when lagging retailers or banks will assume liability for fraudulent card use depending on who is least prepared to accept the EMV chip cards. Whether it is fair or not, the deadline is a way to incent the industry to make the transition sooner rather than later.
That’s a start. Hopefully retailers will follow with other security measures and earn a mention on the list of those who haven’t been breached.
- Where have all the hackers gone? – FierceRetail
- Tokenization no POS panacea; retailers need balanced security strategy – Fierce Retail
- Visa won’t budge on fraud liability shift deadline – Fierce Retail
- PCI June 30 compliance deadline looms; big fines possible for retailers – Fierce Retail
- E-Commerce Fraud Could Get Really Bad Post-EMV – Payment Source
What do you believe has checked the rash of data breaches? Do you expect another round of breaches this holiday season? What steps and investments are retailers still failing to take to protect themselves?
Join the Discussion!
11 Comments on "Where have all the hackers gone?"
You must be logged in to post a comment.
You must be logged in to post a comment.
After the Home Depot and Target hacks retailers realized the need to get serious about data security not only to meet consumer expectations, but to stem the multi-million dollar costs of breaches. No matter what retailers do, hackers, whether they are or domestic or foreign, will try to breach security measures. Retailers, and any big repositories of data, must be on constant alert, always implementing the latest security measures. To do any less is a disservice to consumers and their companies.
Holidays are the best and government is the focus for the HackWacks today. When you have lots of news on stuff, that is where the hacks go (according to the TRedd Theory of Hacking Report). We had tons of PR and news on retail before the hacks took place. Now with Hillary and her server/cloud data storage issues the focus shifts to the government and hopefully Hillary’s server. Coming soon — sports and entertainment industry hacks. The HackWacks are moving in that direction.
Who’s to say they have been checked?
It took the federal government six months to figure out it had been hacked, so it seems to me that hackers are getting more and more sophisticated by the nanosecond.
Of course there will be more rounds of hacking — and not just at the holidays. The reasons are simple: There are folks out there who like to solve problems, like how to get past any form of cybersecurity, and there is another group of folks out there that realizes that more and more of the world’s wealth lies relatively unprotected from cybercrime.
It’s an ongoing battle in what will no doubt become an eternal war. There isn’t much to do except to keep trying to stay one step ahead — or at least even — with the bad guys.
I would have to assume the hackers are waiting for the busiest and most active shopping season in fourth quarter instead of mid-year. Not sure if they are checked, especially with news of activation fraud among mobile wallets occurring since the beginning of this year.
I don’t believe there is ANY decrease in the number of hacks nor hack attempts. They are not all publicized, and many are getting thwarted with the use of new tools available. Bottom line, merchants and brands need to take security seriously and employ the tactics that are driving these hackers to “someone else’s sites.”
Any CIO who thinks that the data breach threat has passed should turn in his or her building key. If anything, threat actors are more present than ever. Verizon’s security team believes that most major retailers have active penetrations right now.
The smart people I talk to at dinner events around the country either have implemented tokenization and end-to-end encryption or are planning to, in addition to other measures.
I don’t think there’s been much of a drop in the number of breaches. Maybe a drop in publicity, but not necessarily breaches themselves.
I do think that crooks are finding more interesting targets, like the government.
This will never be over. PCI has nothing to do with it.
I just had to replace my Visa card last week. A careful review of my statements revealed three or four random charges that we could not identify. Hackers are not gone, they are just getting sneakier. It’s frustrating and makes me feel distrustful of doing more shopping with this card.
Just because the federal government is getting breached instead of retailers does not mean there is a suspension of activity. The breaches look for easy targets and organizations keep putting up stiffer hurdles. I do not believe there is a decrease in activity and any organization that lets down its defenses is vulnerable.
I think the attacks are always taking place, it is whether the retailers know there is a breach and how well they are actively defending it. As Xmas comes and transaction increases (as well as retailers do year end tech audit to make sure they are ready for the holiday) I think you will see more news coming out on breaches.