4 ms·
>"The good news is that nearly all of them were protected by good old chip and pin" I assume this means that they didn't store the CVV (CVC2)? It's hard to tel
by mayniac 8y ago
>"The good news is that nearly all of them were protected by good old chip and pin"
I assume this means that they didn't store the CVV (CVC2)? It's hard to tell right now, there isn't a huge amount of reliable information. They may have kept CVC1 info from magstripe cards.
Should go without saying though that chip and pin isn't really bulletproof security, and the last four digits of card numbers can be enough for identity fraud if the attacker is capable, especially in conjunction with other leaked information like addresses and DOB.
- tomalpha 8y agoI don't believe that chip and pin data is stored locally. Assuming that the payment records were from point-of-sale equipment then the entire transaction, including customer information is end-to-end encrypted and wouldn't (couldn't) be stored by the retailer [0]. I guess this either means that mag-stripe transactions do involve storing the card number locally, or there's something else at play here. [0] https://sumup.com/emv-credit-card-chip/ https://sumup.com/emv-credit-card-chip/ (My knowledge of this is limited, so I'd be very interested if I've misunderstood this).
- mayniac 8y agoPOS terminals transmit data back to the computers they're attached to unencrypted, so they can definitely store it if they wanted to. Everything is speculation at this point, I assume they just kept CC and personal info in a db somewhere for no good reason like a lot of companies do but it's really hard to tell as Dixons haven't told the media too much currently.