Michaels, a large U.S.-based arts and craft store chain, said Saturday it is investigating a possible data breach after suspicious activity was detected on payment cards used at its stores.
The company opted to come forward without confirming a compromise because of the "widely reported criminal efforts to penetrate the data systems of U.S. retailers," according to a company statement.
CEO Chuck Rubin[cq] said "it is in the best interest of our customers to alert them to this potential issue" so they can scan payment card statements for unauthorized charges, according to the statement.
The Irving, Texas, company, which had more than 1,105 stores in the U.S. and Canada as of May 2013, said it has contacted federal law enforcement and hired third-party data security consultants. It also owns Aaron Brothers, a 123-store chain in 11 U.S. states.
If Michaels confirms a breach, it would become the latest victim in a string of data attacks rattling merchants across the U.S. High-end retailer Neiman Marcus and department store Target announced data breaches earlier this month.
Both of those breaches occurred after attackers installed malicious software on their network that collected payment card details.
Target said as many as 40 million payment cards and up to 70 million other personal records were compromised between Nov. 27 and Dec. 15, 2013. CEO Gregg Steinhafel[cq] said malware was installed on point-of-sale terminals used to swipe cards.
Neiman Marcus said between July and October 2013, malware "scraped" payment card information from its system before the company learned of the fraud in December.
Security experts have seen point-of-sale malware for sale on underground forums since at least March 2013. The Target malware is believed to be a derivative of malware called "Kaptoxa," which is Russian for "potato."
That malware, also called "BlackPOS," steals unencrypted card data just after it is swiped and sits in the POS terminal's memory. This type of malware has also been termed a "RAM scraper."
Last week, a 23-year-old living in Russia said he contributed code the Kaptoxa malware. Rinat Shabayev[cq], who lives in Saratov, Russia, told Lifenews.ru that the program could be used for illegal purposes but was intended as a defensive tool.
Computer security experts believe that Shabayev used an online nickname "ree4" and may have sold copies of the program for $2,000 or for a share of the profits. He hasn't been charged, although experts think his customers may be behind the attacks.
There are many indications on underground forums that point-of-sale hacking campaigns are continuing, said Dan Clements[cq], president of the cyberintelligence company IntelCrawler.
One hacker, believed to be based in the U.K., has posted a video on YouTube showing access to the system of an events company in the U.S. midwest. The company has not responded to a request for comment.