More Than 60 Barnes & Noble Stores Suffer Credit Card Breach From Compromised Keypads

Barnes & Noble, the nation’s largest book chain, has suffered a data breach resulting in the loss of customer credit card data. Notification of the breach was withheld for more than a month at the request of the FBI.

Barnes & Noble insiders, who orginally spoke to the New York Times, said that the breach was the result of a compromise to the terminals where customers would swipe cards. The company initially learned of the data theft in September, but withheld notification to customers and the public for a month at the behest of law enforcement.

“We have acted at the direction of the U.S. government and they have specifically told us not to disclose it, and there we have complied,” a Barnes & Noble official told the Times in a statement. 

The book chain is still investigating the incident, and has so far not released much in the way of information. What is known is that keypads used at the registers were compromised; leading to speculation that it was an insider job or a highly sophisticated attack.

The stolen information was used to make unauthorized purchases, the company said, but those actions tapered off towards the end of September. The company has said that customers should change their PINs if they shopped at one of the 63 stores impacted by the incident, and watch for unauthorized activity on those accounts.

Stores in California, Connecticut, Florida, Illinois, Massachusetts, New Jersey, New York, Pennsylvania, and Rhode Island were compromised. A full list with addresses can be seen below. 

The company said it does not currently have PIN pads in any of its nearly 700 stores in the United States.

It is important to note that purchases from college bookstores, BN.com, Nook and Nook Mobile were not impacted by the compromise. 

Related: Skimming PIN Pads – Should PCI Standards Push Upgrades to Newer Technology?

In a statement on Wednesday, the company said the tampering affected fewer than 1% of PIN pads in Barnes & Noble stores.

“[The attack] was a sophisticated criminal effort to steal credit card information, debit card information, and debit card PIN numbers from customers who swiped their cards through PIN pads when they made purchases,” the company said in the statement. “This situation involved only purchases in which a customer swiped a credit or debit card in a store using one of the compromised PIN pads.”  

This is not the first time a large retailer has been hit by such an attack. In May 2011, craft chain Michaels Stores reported that 90 PIN pads across some of its 995 stores nationwide had been compromised. Those attacks resulted in victims reporting fraudulent withdrawals of up to $500 made from ATMs from credit and debit card accounts. Following the incident, Michaels removed approximately 7,200 comparable PIN pads from all its US stores.

As SecurityWeek columnist Robert Vamosi notes, some newer Point of Sale systems in the US have built-in authentication systems designed to protect merchants against fraudulent PIN pads.

“This, of course, requires the merchant to purchase a new terminal, and often upgrade or replace their current POS software as well,” Vamosi wrote. “Some mid-sized businesses might see the benefits and go ahead. Small businesses may not be able to absorb the costs. And, large businesses may chose to roll out such systems over a period of fiscal quarters or years.”

The Payment Card Industry (PCI) Security Standards Council has also issued guidance (PDF) around skimming attacks like this. 

The full list of Barnes & Nobles stores that were breached is included here: