Neiman Marcus CEO says PIN data not accessed in card breach

Share this article:
PIN data is not at risk because the retailer does not use PIN pads in its stores.
PIN data is not at risk because the retailer does not use PIN pads in its stores.

Malware found on the payment systems of Neiman Marcus led to the compromise of card data for an undisclosed number of shoppers, but PIN data is not at risk because the retailer does not use PIN pads in its stores, the company CEO said on Thursday.

Customers impacted in the breach are being notified, Karen Katz, CEO with Neiman Marcus, said in a Thursday statement emailed to SCMagazine.com and posted on the retailer's website.

SCMagazine.com inquired on Thursday as to the number of cards compromised in the data theft and asked for additional details on the malware infection of the company's payment systems, but Ginger Reeder, vice president of communications with Neiman Marcus, said that criminal and forensic investigations are still ongoing.

“Actions we have taken include working with federal law enforcement, disabling the malware we have found, enhancing our security tools, and assessing and reinforcing our related payment card systems in light of this new threat,” Katz wrote.

Neiman was informed in mid-December 2013 of unauthorized payment card activity linked to customer purchases in its stores, according to the statement, which adds that a forensic investigator confirmed on Jan. 1 that a “cyber-security intrusion” had occurred.

Neiman Marcus is offering one free year of credit monitoring services to any customer who shopped with the retailer in the past year. More details about that program are scheduled to be made available on Jan. 24.

A class-action complaint was filed against Neiman Marcus on Jan. 13, which seeks equitable relief for all impacted individuals.

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.