By Brian Krebs
Clothing store chain Eddie Bauer said today it has
detected and removed malicious software from point-of-sale systems at
all of its 350+ stores in North America, and that credit and debit cards
used at those stores during the first six months of 2016 may have been
compromised in the breach. The acknowledgement comes nearly six weeks
after KrebsOnSecurity first notified the clothier about a possible
intrusion at stores nationwide.
On
July 5, 2016, KrebsOnSecurity reached out to Bellevue, Wash., based
Eddie Bauer after hearing from several sources who work in fighting
fraud at U.S. financial institutions. All of those sources said they’d
identified a pattern of fraud on customer cards that had just one thing
in common: They were all recently used at some of Eddie Bauer’s 350+ locations in the U.S. The sources said the fraud appeared to stretch back to at least January 2016.
A spokesperson for Eddie Bauer at the time said the company was
grateful for the outreach but that it hadn’t heard any fraud complaints
from banks or from the credit card associations.
Earlier today, however, an outside public relations firm circled back
on behalf of Eddie Bauer. That person told me Eddie Bauer — working
with the FBI and an outside computer forensics firm — had detected and
removed card-stealing malware from cash registers at all of its
locations in the United States and Canada.
The retailer says it believes the malware was capable of capturing
credit and debit card numbers from customer transactions made at all 350
Eddie Bauer stores in the United States and Canada between January 2,
2016 to July 17, 2016. The company emphasized that this breach did not impact purchases made at the company’s online store eddiebauer.com.
“While not all transactions during this period were affected, out of
an abundance of caution, Eddie Bauer is offering identity protection
services to all customers who made purchases or returns during this
period,” the company said in a press release issued directly after the markets closed in the U.S. today.
Given the volume of point-0f-sale malware attacks on retailers and
hospitality firms in recent months, it would be nice if each one of
these breach disclosures didn’t look and sound exactly the same. For
example, in addition to offering customers the predictable and
irrelevant credit monitoring services topped with bland assurances that
the “security of our customers’ information is a top priority,” breached
entities could offer the cyber defenders of the world just a few
details about the attack tools and online staging grounds the intruders
used.
That way, other companies could use the information to find out if
they are similarly victimized and to stop the bleeding of customer card
data as quickly as possible. Eddie Bauer’s spokespeople say the company
has no intention of publishing these so-called “indicators of
compromise,” but emphasized that Eddie Bauer worked closely with the FBI
and outside security experts.
For more on the importance of IOCs in helping to detect and ultimately stymie cybercrime, check out last Saturday’s story about IOCs released by Visa in connection with the recent intrusion at Oracle’s MICROS point-of-sale unit. And
for the record, I have no information connecting this breach or any
other recent POS malware attack with the breach at Oracle’s MICROS unit.
If that changes, hopefully you’ll read about it here first.
Images of the violence were broadcast nationwide just hours after Freddie Gray was eulogized at his funeral, and Gray’s family and clergy members called for calm. Gray died of an injury he suffered while in police custody.
The rioting did not appear to stem from any organized protests over Gray’s death.
Monday night’s Baltimore Orioles game at Camden Yards near the Inner Harbor was postponed out of concern that the violence would spread five miles east.
Police from surrounding communities were called in to help. Gov. Larry Hogan (R) declared a state of emergency in the city and activated the National Guard.
“I have not made this decision lightly,” Hogan said. “The National Guard is the last resort in order to restore order. . . . People have a right to protest and express their frustration, but Baltimore City families deserve peace and safety.”
The officers were injured — some with broken bones and at least one rendered unconscious — shortly after the violence began about 3 p.m. Two officers remained hospitalized late Monday; they had been hit with items thrown mostly by school-age youths, police said. Officers in full riot gear were pelted with rocks and bottles as they moved in to arrest some of the dozens of young people who had assaulted them.
Mobs destroyed police cars, started several small fires, and invaded a check-cashing agency and sought to break into its ATM. Looters carried off armloads of merchandise from liquor stores and a CVS pharmacy at Pennsylvania and North avenues that also was set ablaze. By nightfall, 27 people had been arrested.
Mayor Stephanie Rawlings-Blake (D) late Monday blamed the violence on “thugs who always want to incite violence and destroy our city.”
“Too many people have spent generations building up this city for it to be destroyed by thugs who, in a very senseless way, are trying to tear down what so many have fought for,” she said. “Tearing down businesses, tearing down and destroying property — things that we know will impact our community for years.”
In response to the violence, the mayor said the National Guard would help city police, and she announced a citywide curfew from 10 p.m. to 5 a.m. for the next week.
Baltimore City school officials announced that schools will be closed Tuesday. Officials at public schools in Montgomery, Prince George’s and Anne Arundel counties have canceled planned field trips to Baltimore.
The mobs for a time seemed undaunted by police and even cut holes in a fire hose as firefighters tried to douse the blaze at the pharmacy.
Later Monday, a three-alarm fire severely damaged a senior center under construction adjacent to a church in the eastern part of the city. It was unclear whether that was related to the violence in West Baltimore.
A spokesman for Rawlings-Blake told the Associated Press that it was, but a fire department spokesman, Samuel Johnson, told The Washington Post that the blaze was not related. At the scene, a fire official said the cause was still under investigation.
Monday’s violence, along with a protest march Saturday night that ended with mayhem, marred what had been a week of peaceful protest after Gray’s death.
Gray, 25, died of a severe injury to his spine a week after police subdued him in an April 12 arrest. Federal and local authorities are trying to determine how the injury occurred.
Gray’s name was added to the roster of black men who have died in recent months in encounters with police, including Michael Brown in Ferguson, Mo., Eric Garner on Staten Island, and Walter Scott in North Charleston, S.C.
“Every time you come into this community you bust heads,” Ochilo Kelo, 35, said to police officers as they moved into the area of the CVS, near where Kelo lives. “And I ask you an intelligent question, and this is how you respond? With batons? Come on. I know you hear me. If we could just talk, all this would stop. This is my city. I don’t want this.”
“Eight hours of peaceful protest and all we got to show for it is a riot,” Kelo said.
Gray family attorney William “Bill” H. Murphy Jr. said the family was “fearful” the rioting would eclipse the investigation into Gray’s death.
“This could damage the justice we’re trying to get for Freddie,” Murphy said. “If this becomes widespread, the mood in Baltimore will shift from what went wrong with the police and Freddie to how the police are doing a great job at securing this chaos. This won’t solve the police problem. This is dangerous to the movement.”
As police departments from surrounding jurisdictions dispatched reinforcements to Baltimore, officers formed human cordons to contain the violence and prevent it from moving to the downtown area that includes hotels, restaurants and the Camden Yards ballpark.
The Rev. Duane Simmons, pastor of Simmons Memorial Baptist Church, stood in front of his church, which is a block away from the burned-out CVS, and shook his head in frustration.
“It is heart-wrenching, but it is something that we have been anticipating,” Simmons said. “People are frustrated. It is like a rat who has been backed into a corner. These folks have had enough.”
Simmons left his church to attend a meeting of church leaders who sought to come up with a solution to the violence.
Police, though, declined to link the protests following Gray’s death to the criminal activity Monday, when television cameras captured looters casually walking out of the CVS, the liquor stores and the check-cashing store with as much merchandise as they could carry. Some posed for photos or selfies in front of a police car that had been destroyed.
The possibility of Monday’s violence began to emerge about 10 a.m., when social-media users warned of large crowds, looting and rioting at Mondawmin Mall sometime after 2:30 p.m. or after school. Several people tweeted warnings and urged their Twitter followers to avoid the mall and to stay safe. Some businesses and universities said they were warned by police that the day could turn violent. Many businesses near the mall and others downtown closed early in anticipation of trouble.
Officials “pre-deployed” to an area near the mall in response to the information gathered on social media, said Col. Darryl DeSousa of the Baltimore police. Officers found about 75 to 100 school-age young people in the area, and a confrontation quickly escalated, he said.
U.S. Rep. Elijah E. Cummings (D-Md.), whose district includes the West Baltimore neighborhood where the violence occurred, said he heard a rumor as he left the funeral service for Gray that there might be a disturbance.
“We never expected anything like this,” he said. “There are different elements here. You have some people who are genuinely upset over what happened to Mr. Gray. You’ve got another group that may just want to take advantage of that.”
The Baltimore police clearly took pains Saturday to avoid confrontation during a five-hour protest march, and again on Monday, they attempted to contain the outbreak rather than wade into the crowd.
The first group to enter the core area where the violence occurred was a group of a dozen or more religious leaders led by the Rev. Jamal Bryant, members of the Nation of Islam and students from Morgan State University. The groups of men began to engage, press back and disperse youths who had been hurling rocks in the general direction of the police.
“This is not what Baltimore stands for,” Bryant, who helped organize protests after Gray’s death, told CNN. “I am asking everyone to go home and clear the streets. This does not represent the Gray family, nor does it represent the last seven days of peaceful protesting.”
When looters broke into a cellphone store, members of a religious group chased them out and formed a wall of bodies to block the entrance.
A blue armored police riot vehicle broke up one crowd that was trashing a police car — apparently unoccupied — and more than a dozen officers emerged with long guns at the ready, arresting one man as others fled. When firefighters and police reached the burning CVS, some faced stones and bottles thrown by the handful of remaining people.
Barbara Taylor, 60, who has lived in the area near the CVS for 15 years, said she spoke to teenagers carrying cases of soda and iced tea away from the store.
“All I can see is crime,” Taylor said. “The people doing this don’t live around here. They’re kids coming into our neighborhood and breaking it apart. There is no reason for this.”
A neighbor, Darlene Dorsey, said the streets would calm if police take action against the officers involved in Gray’s arrest.
“Just arrest the police who did it and all this will stop. They are taking way too long,” Dorsey said.
President Obama spoke with Rawlings-Blake earlier Monday and was said to be receiving updates from Attorney General Loretta Lynch and White House senior adviser Valerie Jarrett.
Hogan canceled his planned schedule for Tuesday.
“Today’s looting and acts of violence in Baltimore will not be tolerated,” Hogan said in a statement Monday. “My thoughts and prayers go out to the men and women in uniform who are actively working to stem this violence and several who have been injured in the line of duty. These malicious attacks against law enforcement and local communities only betray the cause of peaceful citizens seeking answers and justice following the death of Freddie Gray.”
As the sun set Monday evening, police reported that looting was continuing at Mondawmin Mall, where the rioting started, and also along Eutaw Street, a little closer to the Inner Harbor.
“I’m at a loss for words,” Rawlings-Blake said. “It is idiotic to think that by destroying your city that you’re going to make life better for anybody.”
The mayor and police officials say they will review surveillance video carefully and use it to make arrests. “We will be holding people accountable,” she said.
DeNeen
Brown, Lynh Bui, Julie Zauzmer, Ovetta Wiggins, Mary Pat Flaherty, Dana
Hedgpeth, Martin Weil, Clarence Williams and Keith Alexander
contributed to this report.