Nieman Marcus Reports Unauthorized Access to Online Accounts

Department store Neiman Marcus announced that data has been stolen for 5,200 of its customers. The company stated the information was obtained from customers who have reused their passwords across online sites. Since there does not appear to be evidence that an intruder has compromised the Neiman Marcus databases, this is not out of the question. However, it does bring up a couple of important reminders.

Reusing passwords across sites is risky, because cyber criminals are using this method of entry more often than ever before. That is because it actually works. This was blamed in the TaxAct incident early this year as well as FitBit and a host of others. Therefore, not only should Neiman Marcus customers change passwords, but anyone using the same passwords on multiple sites should start making changes immediately and make sure each site has a unique password.

Any time account information is retrieved, there may be an uptick in phishing attempts using that information. Neiman Marcus customers should be on the lookout for messages that could be trying to gain additional details, such as social security numbers, bank account details, or other personal information. If a message arrives appearing to be from the store, make sure it is legitimate before clicking on links or opening attachments inside. They may be loaded with malware.

Approximately 70 customers were refunded money from fraudulent purchases related to this. Though not pointed out, it is likely that users had their credit card details stored in their accounts for efficient purchasing. While this is certainly faster when shopping online and more convenient than having to enter card information each time, there is also this risk. Therefore, it is not recommended to leave credit cards “on file” in online accounts.

According to the company, the hackers were not able to view details such as full credit card numbers and expiration dates. What they were able to see were basic contact details, the last four digits of credit card numbers, and purchase histories.

Pressure is on merchants and financial institutions to step up authentication on online accounts, as an incident such as what happened to Target and Home Depot resulted in those stores losing customer loyalty. Some reports state that one in four persons who were fraud victims in such cases, avoid returning to those stores.

Another concern is the massive database that is being created underground that collects customer personally identifiably information (PII). Some researchers have found large amounts of data for sale on the Dark Web that cyber criminals are collecting and pairing with other information, such as what can be found on social media to create profiles of American citizens. This can all be used by criminals to break into financial institutions, by nation states to gain information on corporations, or even by terrorists to launder money, or any number of other things. It’s always wise to limit what personal details are shared on social media.

Neiman Marcus claims this is not related to the 2014 breach in which affected roughly 350,000 payment cards. Other stores that may have been affected include Bergdorf Goodman, Last Call, Horchow, and CUSP.  Customers with accounts on those sites are also urged to change passwords.