3 ms·
"The good news is that nearly all of them were protected by good old chip and pin". - So what data is usually stored for chip and pin users? - Does that mean n
by ilarum 8y ago
"The good news is that nearly all of them were protected by good old chip and pin".
- So what data is usually stored for chip and pin users?
- Does that mean non-chip and pin users' entire card data was stored in DB?
- PuffinBlue 8y agoI would suggest it reveals that the breach wasn't an attempt to breach a database or static record of details but an attack on the processing of cards during payment in their POS card machines. Sounds similar to that attack on Target a few years back that targeted the POS electronic card readers themselves.
- mayniac 8y ago>"The good news is that nearly all of them were protected by good old chip and pin" I assume this means that they didn't store the CVV (CVC2)? It's hard to tell right now, there isn't a huge amount of reliable information. They may have kept CVC1 info from magstripe cards. Should go without saying though that chip and pin isn't really bulletproof security, and the last four digits of card numbers can be enough for identity fraud if the attacker is capable, especially in conjunction with other leaked information like addresses and DOB.
- tomalpha 8y agoI don't believe that chip and pin data is stored locally. Assuming that the payment records were from point-of-sale equipment then the entire transaction, including customer information is end-to-end encrypted and wouldn't (couldn't) be stored by the retailer [0]. I guess this either means that mag-stripe transactions do involve storing the card number locally, or there's something else at play here. [0] https://sumup.com/emv-credit-card-chip/ https://sumup.com/emv-credit-card-chip/ (My knowledge of this is limited, so I'd be very interested if I've misunderstood this).
- mayniac 8y agoPOS terminals transmit data back to the computers they're attached to unencrypted, so they can definitely store it if they wanted to. Everything is speculation at this point, I assume they just kept CC and personal info in a db somewhere for no good reason like a lot of companies do but it's really hard to tell as Dixons haven't told the media too much currently.
- Rjevski 8y agoThe data stored is always the same. The point is that for Chip & PIN cards, the banks don't expect any magstripe transactions at all (for markets where EMV is in effect, like the UK), which means the card data would be pretty useless as anyone attempting to use them would trip all kinds of fraud alerts. I would not worry about the card data. What's much more important is the other stuff like loyalty cards, etc.
- isostatic 8y agoLast time I bought something from currys, they wanted to know my postcode and name. SW1A 2AA (number 10), so good luck using the personal information of "Larry Felixton" who lives there.