{"id":32822,"date":"2014-01-29T08:07:03","date_gmt":"2014-01-29T16:07:03","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=32822"},"modified":"2025-08-18T00:56:04","modified_gmt":"2025-08-18T07:56:04","slug":"michaels-data-breach","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/privacy-identity-protection\/michaels-data-breach\/","title":{"rendered":"Hackers Pull off a Crafty Attack on Michaels"},"content":{"rendered":"

Customers of nationwide arts and crafts retailer, Michaels, may have something messier to clean up than their latest DIY creation. It appears as though Michaels is the latest victim in a string of cyber attacks targeting major U.S. brands. This attack follows data breaches at Target and Neiman Marcus, making this the third cybercriminal attack on a nationwide retailer less than one month into the New Year.<\/p>\n

According to security blogger, Brian Krebs<\/a>, credit and debit cards used at Michaels stores have been linked to hundreds of fraudulent transactions occurring over the past few days. Though Michaels has yet to confirm this potential security breach, they\u00a0have\u00a0issued a statement warning of its potential. The U.S. Secret Service has also come forward to aid the investigation.<\/p>\n

Unfortunately for Michaels, if this breach does turn out to be legitimate, it will be the second time the company has been hit by such a scam in the past three years. In 2011, Michaels reported<\/a> that point-of-sale systems in a small number of their retail stores were found to have been tampered with by thieves. This high-profile attack resulted in the theft of payment card information for approximately 94,000 Michaels\u2019 shoppers<\/a>.<\/p>\n

There is no information on how many consumers may have been affected this time around, nor is it known how long this attack may have gone on unnoticed. One can only hope that the scale does not match the large numbers of affected customers from the Target or Neiman Marcus breaches.<\/p>\n

At this time, it is also unclear how <\/i>the scammers were able to obtain Michaels\u2019 customer data (if in fact they were), but it is entirely possible that this breach is part of a larger attack plan. Reuters reported earlier this month<\/a> that the same group of cybercriminals who struck Target and Neiman Marcus had set their sites on a number of smaller retailers as well. With more than 1,000 retail locations nationwide, Michaels isn\u2019t exactly \u201csmall,\u201d but timing and approach appear to be in step with the previous attacks. As one of Kreb\u2019s sources explains, \u201cIt really does look like kind of the way we saw the Target breach spin up, because the fraud here isn\u2019t limited to one store or one area, it\u2019s been all over the place.\u201d<\/p>\n

With Target and Neiman Marcus, cybercriminals used malware<\/a> to compromise the software on the point-of-sale machines at these retailers\u2019 physical locations. This approach may also be the method used in the latest Michaels\u2019 heist and is different than the attack that struck the crafting retailer in 2011, as compromising the software<\/i> behind the point-of-sale device doesn\u2019t require the criminal to physically enter the store and tamper with the machines. As a result, this time around cybercriminals were able to steal data at what appears to be a nationwide level, versus the more localized scam of 2011.<\/p>\n

Steps to Leg Up On Cybercriminals<\/h2>\n

With the increase of point-of-sale attacks at many of the retail stores you know and love, what can you do to protect your data and financial well-being? Follow these steps below to get a leg up on cybercriminals:<\/p>\n