Goodwill Industries confirmed on Sept. 3 that it was in fact the victim of a data breach; surprisingly, however, that breach is not the result of Backoff point-of-sale (PoS) malware.
The Goodwill breach was initially reported on in July by eWEEK and other media outlets as being under investigation by Goodwill and the U.S. Secret Service.
Goodwill is an international organization that helps families and individuals in need with job training and other services. It funds its efforts in part through a network of retail locations where donated goods are sold.
Lauren Lawson-Zilai, director of public relations and national spokesperson for Goodwill Industries International (GII), told eWEEK in an email that when the organization became aware of the data security issue, it informed the public on July 21. Since then, Lawson-Zilai said that GII and the 20 impacted Goodwill members engaged a third-party forensic expert to conduct an extensive investigation. GII and the 20 Goodwill members have been working closely with federal law enforcement authorities to determine the facts, she added.
With the forensic investigation complete, GII is now providing details on what actually occurred. That attack is thought to have been operational between Feb. 10, 2013, and Aug. 14, 2014, and was directed against a third-party vendor’s systems. In total, 20 Goodwill members responsible for 330 Goodwill stores were affected by the breach. Approximately 868,000 credit cards are potentially involved in the data breach.
“The third-party vendor’s affected systems contained payment card information such as names, payment card numbers and expiration dates of these 20 Goodwill members’ customers,” Lawson-Zilai said. “There is no evidence that other customer personal information, such as addresses or PINs, was affected by this issue.”
Lawson-Zilai stressed that the malware found on the third-party vendor’s systems no longer presents a threat to individuals shopping at the impacted Goodwill members’ stores. She added that the investigation found no evidence of malware on any Goodwill internal systems.
The issue of retail PoS malware has been a growing concern in 2014, with breaches of a number of businesses, including Target, Neiman Marcus, UPS and perhaps Home Depot. The Secret Service has warned that 1,000 U.S. businesses could potentially be impacted by the Backoff PoS malware. Goodwill, however, is not one of those 1,000 retailers.
“Our outside forensic expert has confirmed that the malware is known as rawpos, according to the Symantec reference,” Lawson-Zilai said. “This data compromise incident is not related to the Backoff malware.”
The rawpos malware is rated by Symantec as having a low risk level and is identified as being a Trojan that was first discovered in February of this year.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.