Card skimmers eyed in Sam's Club data theft
An Alabama Credit Union official says the breach may affect thousands of customers
December 14, 2005 12:00 PM ETComputerworld -
A victim of the recent Sam's Club security breach suggested that fraudsters may have stolen credit card information by using illegal "card-skimming" devices attached to the pumps at the company's gas stations. The fraudulent activity may also have been going on for a longer period than that suggested by the wholesale giant, and it may affect thousands of people (see "Update: Security breach at Sam's Club exposes credit card data").
Sam's Club, a division of Bentonville, Ark.-based Wal-Mart Stores Inc., said in a brief Dec. 2 statement that it was investigating a security breach that had exposed the credit card data of an unspecified number of customers who bought fuel at its gas stations between Sept. 21 and Oct. 2. The company said it was alerted to the problem by credit card issuers whose customers were complaining of fraudulent charges on their statements.
Apart from saying that "electronic systems and databases used inside its stores" were not involved, Sam's Club officials have refused to disclose what happened. They have not returned repeated telephone calls for comment.
The breach prompted the Alabama Credit Union (ACU) to block and reissue debit cards to about 500 of its customers after it learned of the problem last week. The ACU was alerted to the breach by Credit Union National Association Inc., according to Kayce Bell, chief operating officer at the Tuscaloosa, Ala.-based credit union.
The fact that one institution alone had to block so many cards suggests that the breach may have affected a lot more than the 600 or so victims Sam's Club said it knows about, said Avivah Litan, an analyst at Gartner Inc. in Stamford, Conn.
In fact, ACU President Steve Swofford, in comments posted on the credit union's Web site, said that the breach affects "many, many cardholders, card issuers and financial institutions.
"We are certain, in the coming days, more card issuers and financial institutions will be contacting their cardholders to take similar action to prevent fraudulent transactions from occurring," Swofford said. "We're aware of at least one large financial institution in Alabama that has more than 4,000 cards affected, but they have made no public announcement yet.
Dan Zerkle, an employee at a large California software company who was a victim of the breach, told Computerworld via e-mail today that he believes thieves got his data by placing their own counterfeit card reader over the regular credit card reader on the gas pump. "I remember the credit card reader looking different," he said. "Unfortunately, I realized what this
Security
Additional Resources



White Papers & Webcasts
IDC Research Report: The Business Value of Consolidating on Energy-Efficient Servers
Download this Resource Now!
HP Technology Guide for Scalable Business Solutions
Download This Resource Now!
Architecting Business Intelligence Applications for Change: The Open Solution
Register for this webcast today!
Clipper Group Report: HP Provides Enhanced Options for Data Center
Download this Resource Now!
Enterprise Data Governance: Bridging the Business-IT Gap
Register for this live webcast today!
Technology Brief: Technologies in HP ProLiant G6 c-Class server blades with Intel Xeon processors
Download this Resource Now!
Informatica 9 Launch: Transform your Business. Transform your world.
Business and IT will finally be on the same page. Data quality issues will be a thing of the past. The promise of...
Introducing the HP ProLiant G6 servers
Download this Resource Now!
Lower IT Costs with Oracle Database 11g Release 2
Register for this webcast now!

