The Neiman Marcus hackers moved unnoticed in the company’s computers for more than eight months, sometimes tripping hundreds of alerts daily because their card-stealing software was deleted automatically each day and was constantly reloaded. The hackers set off alerts in the company’s security systems an estimated 60,000 times as they worked through networks.
Card data were taken from July through October. The breach was almost certainly not the work of the Target hackers who stole 40 million credit card numbers. “The code style and the modus operandi look totally different,” said Aviv Raff, chief technology officer of Israel-based Seculert. “The attackers were using a specific code for a specific network, and the way they were writing their code doesn’t seem to be related to the way that the attackers on the Target breach were.”
The company’s investigation has found that the number of customer cards exposed during the breach was lower than the original estimate of 1.1 million. The maximum number of customer cards exposed, is less than 350,000, Ginger Reeder, spokeswoman for Neiman Marcus says. Approximately 9,200 of those have been used fraudulently since the attack, she says.
The U.S. Secret Service is leading both the Target and Neiman Marcus investigations.
