As elaborated, Rutter’s came to know of the incident from a third-party report, following which, they began investigating the matter. Digging further unveiled evidence of unauthorized access to their point-of-sale terminals.
On January 14, 2020, the investigation identified evidence indicating that an unauthorized actor may have accessed payment card data from cards used on point-of-sale (POS) devices at some fuel pumps and inside some of our convenience stores through malware installed on the payment processing systems.The malware then scanned the cards used in transactions to pilfer cardholder names, card number, date of expiry, and internal verification code. However, for EMV cards scanned on EMV POS devices, the malware could only access the card number and expiration date.
The attack continued to exist on the POS systems for about seven months, that is, from October 1, 2018, to May 29, 2019. Yet, it persisted in a varying manner at various locations during this time period.
The malware has been removed, and we have implemented enhanced security measures. We also continue to work to evaluate additional ways to enhance the security of payment card data. In addition, we continue to support law enforcement’s investigation.While they have publicly disclosed the incident, they have also shared the details about the locations affected during the incident and the duration of the attack. Users can visit this link to see the list of affected locations.
The firm also advised users to vigilantly monitor their transactions for any unauthorized activity.
Earlier, another US venture, Landry, also disclosed a breach following a POS malware attack that also lasted for seven months.
Let us know your thoughts in the comments.
