November 29, 2013: People shop at a Target store during Black Friday sales in the Brooklyn borough of New York (REUTERS/Eric Thayer/File)
At least three other well-known retailers in addition to Target and Neiman Marcus were apparently hit by cyber attacks over the holiday shopping season that have not been publicly disclosed.
Reuters reported late Saturday that breaches may have also occurred at some retailers earlier in 2013. The report cited people familiar with the attacks who declined to name the retailers, but said the method of the attacks was similar to the one against Target, in which the personal information of at least 70 million customers were stolen. Target originally disclosed the breach on December 19, saying that only 40 million payment card numbers had been stolen.
Reuters reported that authorities suspect the ringleaders behind the hacks are based in Eastern Europe. One source said that hackers were more sophisticated than those behind earlier breaches.
Avivah Litan, a security analyst for Stamford, Connecticut -based Gartner information technology research firm, told Reuters that she was informed about a separate set of breaches months before the start of the holiday shopping season. Investigators believe those attacks may have been trial runs for the larger attacks late last year.
"Target was not the only retailer who got hit," Litan said, "but they got hit the biggest."
Law enforcement officials also said that they believe the hackers used a variety of tools and techniques to capture the encrypted data, including a malware device called a RAM scraper, which captures encrypted data as it passes through a computer's live memory.
Neiman Marcus, an upscale, Dallas-based retailer, said that an outside firm discovered evidence of a cyber attack on January 1. The breach was acknowledged by the company nine days later. Neiman Marcus has said it is not sure if its breach was related to the Target breach.
It was not immediately clear if any of the companies involved in the latest reported breach had contacted customers to inform them that their information had been compromised.
Get a daily look at what’s developing in science and technology throughout the world.