September 8, 2016 By Larry Loeb 2 min read

Point-of-sale (POS) malware used to be limited to Verifone-style data terminals that were hardwired to a register at a retail establishment. That aspect of a point-of-sale data breach has changed drastically of late, with POS software moving to the cloud.

Point-of-Sale Data Breach Targets Mobile Database

Lightspeed, a POS provider that serves over 38,000 business clients, announced last Thursday that it had suffered a breach, CSO Online reported.

The breach affected a system that allows clients to connect via mobile devices. In a statement, the company said the attack targeted a database that stored specific client information regarding products, sales and encrypted passwords that can be used to access the system.

No Evidence of Stolen Data

In a worrisome development, the company said attackers also accessed electronic signatures that had gone through the POS software. However, the statement claimed there was no evidence that the data was stolen or otherwise used for criminal purposes.

“It’s worth noting that Lightspeed does not store credit card information, and therefore no cardholder data was compromised in this incident,” a company spokesman told CSO Online in an email.

If the customer data is safe, it may have been due to the company’s practice of encrypting its passwords at rest. In its statement, Lightspeed said it was using an “advanced encryption technology” that had been upgraded in January 2015.

Remediation Steps

The provider is taking remediation steps right now. It is limiting personal access to the company’s production infrastructure as well as its sensitive data. It’s always a good idea to keep as many hands off the production machines as possible.

In addition, the company is upgrading its security to detect more advanced attacks. It did not disclose which advanced attacks it thought were worth detecting.

Security frontiers and perimeters have changed over time. Even though user and customer data were protected to some degree, a breach was still possible. Perhaps Lightspeed’s threat model was incomplete or deficient in some area. The company obviously took steps toward hardening its system, since it encoded the credentials at rest.

Still, given the accessibility of customers’ e-signatures, there was obviously a vulnerability that was not detected. The whole affair illustrates the importance of re-evaluating the threat model continually, even when it seems a decent solution is already in place.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today