Loading story…
Target, Neiman Marcus, and Home Depot disclosed major payment-card breaches in which attackers planted point-of-sale malware on in-store checkout systems and harvested customer data at scale. Target said about 40 million payment cards were exposed during the 2013 holiday shopping period, with later estimates rising to as many as 110 million people affected when personal information was included. Reporting tied the Target intrusion to customized memory-scraping malware related to BlackPOS, which was used to collect card data from checkout terminals and stage it on internal servers before exfiltration; investigators and the U.S. Secret Service were drawn into the case as the breach became one of the largest retail compromises on record. Neiman Marcus also reported that its breach was worse than first disclosed, adding to the wave of retail intrusions.
Home Depot later revealed a similarly large compromise affecting its U.S. and Canadian self-checkout systems, saying attackers stole more than 56 million payment card numbers and over 53 million email addresses after entering through credentials taken from a third-party vendor and moving laterally through the network. The incidents intensified pressure on U.S. retailers and payment providers to move away from vulnerable magnetic-stripe cards toward EMV chip technology, while also imposing steep business costs: Target reported a sharp profit decline, tens of millions of dollars in breach-related expenses, and warned that litigation, fraud losses, and investigative costs could continue to materially affect results. Together, the breaches showed how weak vendor access controls, hard-to-detect POS malware, and outdated payment technology enabled large-scale theft of card data from major retailers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Home Depot disclosed that attackers stole more than 56 million payment card numbers and over 53 million email addresses in a major breach. The company said it had removed the malware, worked with law enforcement and outside investigators, warned customers about phishing risks, and improved payment-system encryption.
Home Depot said malware operated on its U.S. and Canadian self-checkout systems from April through September 2014, capturing payment card data. The attackers initially accessed the network using credentials stolen from a third-party vendor before moving laterally and installing custom malware.
Reporting said Target's FireEye security systems generated multiple alerts as attackers installed tools and moved data during the 2013 intrusion, but the warnings were not escalated in time to stop the breach. The account added a new detail about Target's internal detection and response failures during the incident.
Target reported that fourth-quarter profit fell 46 percent year over year to $520 million following the breach. The company said it had recorded $61 million in pretax breach-related expenses, expected partial insurance recovery, and warned that litigation, fraud claims, and investigative costs could continue to affect results.
Neiman Marcus disclosed that its own payment-card breach was larger than first reported, affecting about 1.1 million cards. The incident became part of the broader wave of major retail payment breaches drawing attention in early 2014.
Reporting said a 23-year-old Russian hacker confessed to being the original author of the BlackPOS malware family tied to major retail payment-card breaches. This added a new attribution detail beyond earlier reporting that had only linked the Target intrusion to BlackPOS/Reedum technically.
New reporting described the malware used in the Target intrusion as a customized memory-scraping point-of-sale threat closely related to BlackPOS/Reedum. The attackers were said to have compromised a Target web server, deployed malware to checkout systems, and used an internal server to collect stolen card data while evading antivirus detection.
Target later said the breach affected personal or payment information for as many as 110 million people, greatly expanding the known scope beyond the initial 40 million payment cards. This broader figure was cited in later January and February reporting.
Target disclosed that approximately 40 million credit and debit card accounts may have been compromised in a breach affecting in-store shoppers between late November and mid-December 2013. The company said it was working with a third-party forensics firm, and the U.S. Secret Service confirmed it was investigating.
KrebsOnSecurity reported that Target was investigating a payment-card breach potentially affecting millions of customers at nearly all U.S. stores during the holiday shopping season. Sources said magnetic-stripe track data was stolen from in-store transactions and that the exposure window may have extended through 2013-12-15.
Attackers began harvesting payment card data from Target store customers around the Thanksgiving/Black Friday period. Reporting places the exposure window starting on 2013-11-27 and continuing into mid-December.
Reporting said the Target attackers first accessed the retailer's network on 2013-11-15 using credentials stolen from HVAC subcontractor Fazio Mechanical Services. The intruders then reportedly spent about 13 days testing card-stealing malware on a limited number of POS terminals before wider deployment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcecnet.com
Open sourcebits.blogs.nytimes.com
Open sourceweb.archive.org
Open sourcekrebsonsecurity.com
Open sourcearstechnica.com
Open sourcewired.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Retailers are facing sustained cyber pressure as attackers target high-value customer and payment data, and consumer trust is increasingly sensitive to breach history and perceived security posture. A SOTI survey cited by *Dark Reading* found **88%** of consumers “think twice” before shopping with a retailer that has experienced a cyberattack, and **22%** would avoid a retailer altogether after a breach; others report changing behavior by avoiding a merchant’s website/social channels or withholding personal information. The article notes ransomware activity has been particularly active against UK retailers and points to ongoing global risk to customer data, with Nike mentioned as a potential recent victim. Separately, ransomware operators are escalating coercion beyond data theft and encryption into more aggressive extortion, including threats of physical harm to executives, according to Semperis research cited in *Dark Reading*. The same commentary highlights that while Chainalysis estimated ransomware payments fell to **$814M in 2024** (down **35%** from 2023), groups are adapting by intensifying pressure on victims who are more likely to pay; it recommends resilience-focused controls such as rapid patching, user education, and **multi-factor authentication**. A TechTarget statistics roundup provides broader context on rising cyber risk (e.g., growth in disclosed vulnerabilities and supply-chain attack impact projections) but does not report on the same specific retail-consumer trust dynamic or the “violent ransomware” trend as a discrete event.
Jun 29, 2026
The Brazilian threat group **Prilex** evolved from ATM jackpotting into a sophisticated point-of-sale malware operation that targeted Brazil’s payment ecosystem, compromising PoS terminals and EFT/TEF software to steal card data and manipulate EMV transactions. Early campaigns reportedly infected more than 1,000 ATMs at a Brazilian bank and were linked to cash theft and the cloning of more than 28,000 payment cards, while later operations focused on merchant environments by modifying PoS software, intercepting communications between terminals, PIN pads, and banks, and harvesting payment data in real time. Researchers said Prilex developed techniques that undermined assumptions about the security of **chip-and-PIN** cards, including the use of a custom Java applet on smart cards to abuse optional EMV transaction steps so terminals could skip card authentication and accept any PIN. More recent variants moved beyond EMV replay to **"GHOST transactions,"** capturing live transaction data and obtaining fresh EMV cryptograms from victim cards for fraudulent purchases. The operation was supported by a broader criminal toolkit that included the **Daphne** card-writing client, a stolen-card database, backdoor and stealer components, and targeted intrusion methods such as social engineering with fake technicians and remote-access tools like **AnyDesk**.
Aug 14, 2026
Kaspersky reported that ATM and point-of-sale malware activity rose sharply in 2018 and remained high in 2019, with detections concentrated in Russia, Brazil, Iran, Vietnam, India, the United States, and several European countries. Russia consistently recorded the highest number of affected devices, underscoring the global scale of attacks targeting payment infrastructure. The report linked the sustained threat to outdated software, unpatched vulnerabilities, weak physical security, and the operational limits of vendor-managed ATM environments. It identified active malware families including **ATMJackpot**, **WinPot**, **Ice5**, **ATMTest**, **Peralta**, **ATMWizX**, **ATMDtrack**, **ATMgot**, **ATMqotX**, and **ATMJaDi**, which support cash-out schemes, card-data theft, and anti-forensic functions, while noting that older malware continues to be reused and that a malware-as-a-service trend is emerging from Latin America.
Aug 14, 2026