Cyber Incident Victim: Kmart
Date:
Sep 2014
Location:
United States of America
Summary
A retail subsidiary experienced a payment system breach involving undetectable malware over approximately one month, compromising credit and debit card numbers without accessing PINs, social security numbers, personal information, or email addresses. The intrusion was detected by internal IT teams, leading to malware removal and collaboration with law enforcement, financial institutions, and security experts; online customers were unaffected. The company offered free credit monitoring to affected individuals while emphasizing ongoing efforts to enhance system security.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Kmart publicly disclosed a payment card data breach on October 10, 2014, through an SEC filing after its internal IT team detected malicious software on October 9. The intrusion had persisted since early September 2014, making the breach active for approximately one month before discovery. Security experts attributed the incident to malware specifically designed to evade detection by contemporary anti-virus systems, which infiltrated Kmart's payment processing infrastructure. The retailer confirmed the compromise of credit and debit card numbers but explicitly stated no evidence indicated theft of debit card PINs, Social Security numbers, email addresses, or other personally identifiable information. Online transactions through kmart.com remained unaffected according to the company's assessment. Kmart initiated immediate containment measures by eradicating the malware from its systems upon identification, though it did not disclose the number of impacted cards or store locations during the initial announcement.
The organization collaborated with federal law enforcement agencies, financial institutions, and third-party cybersecurity firms to investigate the breach's scope and origins. Kmart concurrently implemented security enhancements across its infrastructure while offering complimentary credit monitoring services to customers who made in-store purchases during the exposure window. President Alasdair James issued a public apology acknowledging potential customer inconvenience, reiterating corporate commitments to data security. This incident occurred amid a surge of retail sector breaches in 2014, including contemporaneous disclosures by Dairy Queen (impacting 395 locations) and Home Depot (56 million cards compromised), alongside earlier attacks on Goodwill, PF Chang's, Michaels, and Neiman Marcus. Kmart operated 1,221 physical stores as of February 2013, though the breach's precise geographic distribution remained unconfirmed in initial reporting.