UPDATE: Barnes and Noble Customer Account Breach
By: Big 2 News Staff
Updated: October 24, 2012
October 24, 2012; New York - Barnes & Noble (BKS) has detected tampering with PIN pad devices used in 63 of its stores. Upon detecting evidence of tampering, which was limited to one compromised PIN pad in each of the affected stores, Barnes & Noble discontinued use of all PIN pads in its nearly 700 stores nationwide. The company also notified federal law enforcement authorities, and has been supporting a federal government investigation into the matter.
Barnes & Noble has completed an internal investigation that involved the inspection and validation of every PIN pad in every store. The tampering, which affected fewer than 1% of PIN pads in Barnes & Noble stores, was a sophisticated criminal effort to steal credit card information, debit card information, and debit card PIN numbers from customers who swiped their cards through PIN pads when they made purchases. This situation involved only purchases in which a customer swiped a credit or debit card in a store using one of the compromised PIN pads.
The company emphasized that its customer database is secure. Purchases on Barnes & Noble.com, NOOK and NOOK mobile apps were not affected. The member database was also not affected. None of the affected PIN pads was discovered at Barnes & Noble College Bookstores.
Barnes & Noble is continuing to assist federal law enforcement authorities in this matter. In addition, the company is working with banks, payment card brands and issuers to identify accounts that may have been compromised, so banks and issuers can employ enhanced fraud security measures on potentially impacted accounts.
The criminals planted bugs in the tampered PIN pad devices, allowing for the capture of credit card and PIN numbers. Barnes & Noble disconnected all PIN pads from its stores nationwide by close of business September 14, and customers can securely shop with credit cards through the company's cash registers. Barnes & Noble said it is committed to providing customers with a safe shopping environment.
Tampered PIN pads were discovered from stores in the following states: CA, CT, FL, NJ, NY, IL, MA, PA, RI. A complete list of specific stores follows.
People who've swiped a credit card at a Barnes and Noble store recently might want to take a close look at their bank statements.
The bookstore says customers at 63 stores nationwide may have had their accounts compromised.
Barnes and Noble says hackers broke into the keypads in front of cash registers where customers swipe their credit cards and enter their four-digit PINs... personal identification numbers.
The New York Times reports that the company discovered the security breach around September 14-th.
But sources tell the Times that the Justice Department asked Barnes and Noble to keep the matter quiet, so the F-B-I could figure out who was behind it.
After getting word of the tampering, the bookstore chain disconnected all PIN pads from its stores nationwide.
Customers looking to use a credit card will simply have their cards swiped on the reader attached to the cash register.
