Quantcast StorefrontBacktalk - Techniques, Tools, and Tirades about Retail Technology and E-Commerce
E-Mail Us
Hannaford Had Trojan Installed On 300 Store Servers, One Copy For Each Store
Written by Evan Schuman
March 28th, 2008

The data breach at Hannaford involved a Trojan Horse that was installed on servers at every one of its 300 grocery stores, according to Hannaford officials. The software intercepted card data at the POS and then periodically transmitted them “to an unnamed offshore Internet service provider.”

Those details come courtesy of a letter sent by Hannaford general counsel Emily Dickinson to Massachusetts Attorney General Martha Coakley and Governor Deval Patrick’s Office of Consumer Affairs and Business Regulation, according to Hannaford officials and a report in The Boston Globe, which quoted from the letter. The chain decided to replace all of the servers to make absolutely certain the malicious programs were removed from the network.

Leave a Reply

Search Through Blog Blurbs
Search Through All Stories
Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
StorefrontBacktalk will never sell your E-mail address to anyone at anytime.
Evan Schuman is the former retail technology editor for eWEEK.com, PCMagazine, CIOInsight and retail reporter for RISNews and Consumer Goods Technology. Having covered IT issues for 21 years - and other stuff like legal affairs, politics, Wall Street and the environment for about eight years before that - Schuman is in a good position to gripe about technology trends and sometimes accidentally make a good point.
India's Internet Usage Soars 27 Percent
New stats out of India show three things: a sharply growing acceptance of the Internet (27 percent year-to-year increase); embracing of American sites (the top three most popular sites were from Google, Yahoo and Microsoft); and huge growth potential, given that barely 3 percent of its people today use the Internet.
Wal-Mart: A Chain Of Few Words
Wal-Mart is certainly a company of few words. But when the world's largest retailer (it's expecting to hit $400 billion in annual sales later this year or early next year) wants to make a technology endorsement, a few words are all that's necessary.
Next-Generation Search: Marketers To Try And Use Consumers' Own Games and Cell Phone Cameras
In an eerie snapshot of where some top marketers want to take the next generation of search engines, a Japanese government-backed research project is working on a search that is based on what a user does, not a keyword a user types in.
Staples Trial: 2-Way Live Video Kiosk That Controls Payment, Scanners
Staples' Canadian operation has been quietly testing 2-way live video kiosks at 34 locations, but these kiosks do more than talk with customers: They remotely control hardware, including scanners and payment authorization devices.
Will The Recession Kill PCI Or Bring Needed Rationality?
Guest View Columnist David Taylor points out that PCI compliance has consistently generated larger security budgets, with little or no requirement for justifying them, other than "our bank told us we have to do it."
Forrester: IT Hurdles Still Crippling Merged Channel Efforts
Despite an almost universal embrace of the idea of merged channel, most retailers aren't getting any closer to making it a reality, with overly restrictive inventory reserve policies, inconsistent data and political resistance getting most of the blame, according to a new Forrester Research report.
More Survey Cynicism: IDC On Green Progress
This issue's Reach Of The Week goes to IT analyst firm IDC and its report released Wednesday (July 16) that its survey of 250 execs "found that there is a growing level of commitment" to supporting green programs. So far so good, but let's look a little closer at these IDC figures.
Stop & Shop Running In-Aisle Location Trial
A handful of Stop & Shop stores have been using in-store location tracking—coupled with basket content—to narrowly target ads to customers using handheld shopping devices, the chain confirmed in a statement issued Thursday (July 17).
The Digital Age Divide Is Disappearing
Consumers older than 50 are rapidly growing fond of the Web, with such users checking news, for example, more frequently than those younger than 20 as well as participating in online communities more. But the study found that instant messaging and video downloads were "still tools for young users."
Video Viewing Soars Again In May
For those e-tailers wondering if video is an effective way to reach American consumers, here's the latest video stat, courtesy of Comscore: In May alone, U.S. Internet users viewed more than 12 billion online videos, representing an increase of 45 percent versus one year ago.
Former Hannaford CIO: Avoid Microsoft And Change PCI's Encryption Rules
Bill Homa, who just stepped down July 1 as the CIO for the 165-store Hannaford grocery chain, considers Microsoft's OS to be "so full of holes" and describes the fact that current PCI regs do not require end-to-end encryption as "astonishing."
Are 2-D Barcodes About To Ship On Cellphones? Will That Be Enough To Make A Difference?
Retail deployment of the 2-D barcode, a technology that allows consumer cellphones to see virtually unlimited amounts of content by taking a picture of a special barcode, has slowed after an initial flurry of activity in January. But several major cellphone carriers are preparing to bundle the 2-D barcode software with phones as they ship. Will that make a difference?
Judges, Senators Deciding Web Privacy Issues. Shoot Me Now
Two recent developments—one involving a New York federal judge and the other involving a group of U.S. senators—are signaling serious difficulties for E-Commerce efforts over the next two years.
Data Breach Count Reaches All-Time High, Includes New Facebook, H&R Block Breaches
The number of reported data breaches has been soaring, with the figure from the first six months of 2008 some 69 percent higher than the number from the identical period last year. Among those were little-known recent breaches of Facebook, H&R Block and BearingPoint.
Fujitsu Brings Euro-Style Two-Step Checkout To U.S. Will It Work On Main Street?
Fujitsu is hoping retailers in the United States will embrace a checkout system used by some European stores, but untested in the U.S., that splits scanning and payment processes into two different stations in the store. If American retailers decide to switch to this system, it will call for a significant overhaul of their current checkout systems.
Most Retailers Are Not Yet Ready To Outsource PCI
Guest View Columnist David Taylor argues that outsourcing is considered the thing to do these days, like a summer barbecue. But it's both easier and more complex than most merchants think.
Impinj Buys All Of Intel's RFID Group
RFID vendor Impinj on Thursday (July 10) purchased all of Intel's RFID operation--including the R1000 RFID reader chip. A joint Intel/Impinj statement said that the acquisition details are not being released, but The Seattle Times reported that Intel will get an equity stake in Impinj.
Fooling An Age-Verification System The Low-Tech Way
No sooner had IT concocted a system to try and automatically detect an under-age shopper than someone has crafted a remarkably low-tech way to fool it. How low-tech? How about a picture ripped out of a magazine?
Are Consumers Ready For Home-Scanned And Delivered Groceries?
Will consumers ever deploy counter-top barcode scanners and a Web site to have groceries delivered to them automatically? A company called Ikan.com is hoping they will.
Urban Outfitters Sees 19 Percent Conversion Boost With Single-Page Web Approach
A new E-commerce payment system at UrbanOutfitters.com allows users to complete purchases in one screen, boosting cart conversion rates by 19 percent.
PCI Council To Start Testing Payment Kiosks
The PCI Security Council is branching out a little, with an attempt to bring unattended payment terminals (UPTs) under its jurisdiction. As kiosks get more sophisticated and start taking cash, credit cards, mobile transactions and other payment methods, the UPT security risk is sharply increasing.
Lawsuit Filed To Keep RFID Flaws Secret
A semiconductor company is suing a Dutch university to keep its researchers from publishing information about security flaws in the RFID chips used in up to 2 billion smart cards.
Amazon Makes Good On Its Bill Me Later Promise
Amazon.com on Wednesday (July 9) finally deployed Bill Me Later as a payment option, almost eight months to the day after Amazon announced its intent to do so.
U.K.'s Sainsbury's Site Melts Down A Second Time In Two Weeks
For the second time in two weeks, one of the largest grocery chains in the U.K. hit a snag with its Web site, triggering a 24-hour outage and causing the 823-store retailer to use a temporary homepage. Sainsbury's, a $38 billion retailer, is calling these incidents coincidental.
JCrew Site Slows To A Crawl As Extensive New Features Launch
When the $1.3 billion JCrew apparel chain launched its new Web site on June 29, it was the culmination of a 2-year deployment effort. Seems that customers may have to wait a bit longer to fully use those new capabilities, as the site quickly crashed and has suffered significant slowdowns ever since.
J.C. Penney In-Store Web Access Behind Customer Satisfaction Hike
J.C. Penney customers are twice as likely to say they are highly satisfied with their in-store shopping experience if they are working with store employees who are accessing the company's Web site while standing next to them.
An Ocean Apart: Why A U.K. Retailer Handled A Site Glitch So Differently
When an order processing snafu shut down the delivery operations of one of the U.K.'s largest grocery chains, the $38 billion retailer acted starkly different than the typical U.S. retailer. The London-based 823-store Sainsbury's grocery chain immediately issued almost a half-million dollars' worth of vouchers.
Are App Dev Backlogs Inevitable Or Warning Signs?
A new Retail Systems Research report is challenging the way retail IT looks at application development backlogs. The report is based on a survey showing that some 79 percent of retailers have appdev backlogs of at least a year, with one-fifth of those hitting delays of more than two years.
China's Online Market Stronger Than Most Analysts Think
The conventional wisdom has held that China is not likely to embrace E-Commerce, because of the Chinese aversion to credit payments and fears of piracy and poor quality products. But a Forbes story this week makes a powerful argument that E-Commerce—and a credit-card lifestyle in general—will be coming to China very soon and in a big way.
Medical Study Raises New RFID Fears
Although the question of RFID safety has been debated extensively over the years, with conflicting study results, a major new medical study released this week points to very specific electromagnetic dangers within nine inches of the transmitter.
Report: SMS Does Not Handle Volume Well At All
In one of the first wide-scale studies of SMS' capability to hold up under volume pressure, the technology fared "surprisingly" poorly, according to Keynote Systems. This has particular significance for retailers, who are exploring the technology's use for mobile communications connecting to both online and in-store.
Will Voice Prints Work For Payment Authorization?
A U.K. company is pushing retailers to use voice-recognition to authenticate purchases over the phone and online. The Voice Commerce Group's Voice Transact package has consumers call the service, quote a pre-arranged product code and then a series of digits dictated by the automated system.
Federal Appellate Panel Backs Circuit City In Gift Card Patent Case
A federal appellate court backed a group of retailers Monday (June 23)—including Best Buy, Circuit City, Costco and Lowe's—by ruling that their gift card systems do not violate any patents.
PCI Compliance: Who's Re-Minding The Store?
Internal audit is not staffed to enforce PCI at the store level, argues GuestView Columnist David Taylor. Except for about a dozen leading retailers, most retailers do not have enough IT-skilled internal auditors to meet the requirement for a "continuous" review of store-level IT security.
Wal-Mart Proving That Green Can Indeed Mean Something
Wal-Mart and a handful of others have been trying to do green the right away, with policies that will have a significant environmental impact and that also improve operations.
Oracle's Challenge: Legacy Mindset Goes Far Beyond Legacy Apps
When Oracle finally introduced its Retail 13 integrated suite this week, after three years of acquisition and integration, the teams working for the world's largest enterprise software vendor might have breathed a sigh of relief.
Oracle 13: Swiss-Cheese Integration?
After three years of acquisition and integration, Tuesday (June 17) saw the official launch of Oracle's Retail Release 13, consisting of some 33 retail applications, only four of which were new. The rollout was billed by Oracle as the be-all and end-all of end-to-end integrated retail application suites, but some analysts said the integration was lacking.
Netherland Supermarket Chain Trying Biometric Payment
Are European retailers going to have any better luck than American retailers with consumer-facing biometric payments? The 750-store Albert Heijn supermarket chain, the largest such chain in the Netherlands, is about to find out.
E-Commerce Getting A Bit More Respect
The Moodys Investor Service has upgraded how important a retailer's E-Commerce activity is when assessing that retailer's overall economic health. Although this isn't a radical change for the financial firm—and the thought that E-Commerce is important is hardly surprising—it's one of several recent moves suggesting that the young teen-age Web is starting to be taken a wee bit more seriously.
Report: Self-Service To Top $1.7 Trillion By 2012
North American self-service transactions will process $607 billion this year, a figure that is projected to soar to $1.7 trillion by 2012, according to report published Wednesday (June 18) by the IHL Group. When IHL began work on the report, "I did not expect the acceleration that we're seeing in the out years," said IHL President Greg Buzek. "I did not expect how fast it's growing."

Bank Breach Hits ATMs, No Retailer At Fault This Time
One of the repeated arguments made in retail data security circles is that retailers tend to have much weaker security because it's not as much of a cultural priority as, for example, banking. So it's a little bit consoling that the latest ATM databreach is apparently not the result of a retail breach, not the result of social engineering and the trusting bank clerk, but is the first proven incident of a bank server's breach linked to ATM fraud.
Re-Thinking Payment Gateways
A surprisingly large number of major retailers today are using inhouse or outsourced payment gateways to reduce the scope of their compliance effort as well as their costs. At some point in the last decade, nearly every organization involved in electronic commerce did an evaluation of payment gateways. So, what's changed?
Federal Judge Rejects Ameritrade Settlement
One day after lawyers presented a proposed settlement in the Ameritrade 6.2 million-customer data breach, a U.S. federal court judge tentatively rejected the settlement (on June 13), questioning the value of the deal for the consumer victims and the size of the $1.87 million attorneys' fees.
New Security Reports: Beware Of Your Partners
A pair of unrelated reports out this week are challenging several fundamental IT security assumptions, including that data breach laws will reduce consumer losses and that insiders account for more thefts than external evil-doers.
The Rodney Dangerfield Of Security Controls
GuestView Columnist David Taylor thinks of logging and envisions Rodney Dangerfield. "Whether we're talking about logs generated by network or application firewalls, intrusion detection systems, file integrity monitor tools or the operating systems themselves, I've come to the conclusion that the only people who don't hate them are the vendors who sell them."
In Time For Friday The 13th, Oracle To Roll Out Oracle Retail 13
Just in time for Friday the 13th, Oracle is finally ready to unveil Oracle Retail V 13, with a formal rollout slated for Tuesday (June 17). Oracle's main retail suite is not expected to undergo any radical changes (even the name change is expected to be slight); it's mostly claims of better integration and interoperability.
European E-Tailers Faring Well
E-tailers in continental Europe are just now starting to get hit by slower growth, but they are still shining much more brightly than their U.S. counterparts, according to new figures from eMarketer.
Secrecy Shouldn't Be Convenient
Two incidents this week show how much less respect is paid to the online consumer than the brick-and-mortar one. Does the inherent anonymity in the Web cut both ways? Like the site visitors emboldened by their namelessness who post comments and get into flame wars that they would never have the nerve to try in person, are E-tailers treating their customers with a disrespect that they would never dare consider in a physical store?
Settlement Proposed In Ameritrade's Data Breach Lawsuit
After admitting it had security holes that allowed a security breach of more than 6.2 million customers, attorneys for TD Ameritrade this week agreed to a settlement of a class action lawsuit. The 74-page settlement outlined several efforts by Ameritrade, but it did not include any cash payments to the consumers who sued the company.
Amazon.com Crashes Again On Monday
For the second consecutive workday, Amazon.com suffered a major crash on Monday (June 9), with the increasingly unlikely scenarios explaining why the historically robust site is failing.
Amazon Crashes Friday, Site Complexity Blamed
E-Commerce leader Amazon.com completely crashed for almost three hours on Friday afternoon (June 6), with one Web site performance tracking firm attributing the crash to excessive site complexity.
Best Buy's Spanish E-Commerce Discoveries
When Best Buy launched a Spanish version of its site last fall (2007), E-Commerce officials quickly noticed unexpected activity, such as customers spending twice as much time on the Spanish site.
Starbucks' Wi-Fi Cup Runneth Over
Note to retailers looking to offer free Wi-Fi: It's a good idea to first make sure you can make the offer. Starbucks discovered that an offer of two hours of free Wi-Fi a day simply wasn't working. "Due to overwhelming interest in Card Rewards we are currently experiencing difficulty accessing Starbucks Card accounts. We are working to fix the problem and ask that you please try again later," said a page shown to site visitors.
Meijer Testing Intersection Between Digital Coupons, Shopping Lists And Calendars
The Meijer department store chain—with 182 stores in Michigan, Ohio, Indiana, Illinois and Kentucky—is getting creative with its Web site, food recipes and online coupons.
Is The E-Commerce State Tax Strategy The Right One?
New York State has started pushing to collect sales tax from e-tailers that have no physical presence in the state, prompting Amazon and Overstock to fight back. But all e-tailers are hoping against the odds that other states don't pull the same revenue-generating attempt. If New York gets legal greenlights, several more states will quickly mimic its efforts, leading to a flood of almost every state within two years.
Mobile Madness: What Really Constitutes A Mobile-Friendly Site?
Welcome to E-Commerce Semantics 101. Your philosophical question for the day: When is a site truly mobile-friendly? Mobile commerce today is in that familiar classic battle of Chicken.com versus Egg.com: Retailers know the mobile users are out there, but they also know that few are trying to use the devices for making purchases.
Most U.S. Sites Fail Performance Tests
The worst performance grades were given to Foxnews.com, IGN.com, Gamespot.com, CNN.com, Break.com and ESPN.go.com. The best performance grades were given to Google.com, Live.com, Orkut.com and Craigslist.org.
Security Lessons From Higher Education
GuestView Columnist David Taylor asks: What would you do if one of your employees decided to leverage your brand and set up a little side business inside your store, including selling products via an E-Commerce Web site, setting up a merchant bank account and taking credit cards? You'd probably fire the person, right? But, what if you couldn't?
Why Wal-Mart's $2/Pallet Non-RFID Penalty Isn't Going To Work
Computerworld columnist Frank Hayes has a wonderful column out about why the Wal-Mart RFID effort is still having problems. Hayes makes a great point about how Wal-Mart's $2 per pallet non-RFID penalty reflects a lack of understanding of why suppliers have resisted RFID tagging.
Gap Merges The E-Commerce Backend Of Its Four Brands
Shoppers at Gap.com will now be able to use a single shopping cart and consolidate shipping at any of the chain's four brands, the Gap announced on Tuesday (May 27). But the change for The Gap, Banana Republic, Old Navy and PiperLime is delicate, as the company still wants those brands to maintain their distinct personalities. Those conflicting goals give the new site a bit of a Jekyll-and-Hyde feel.
Borders' New Site: You Can't Always Tell A Book By Its IP Address
Borders this week officially stepped out of the shadow of Amazon and re-launched Borders.com, with an effort that scores points for creativity. The physical side of Borders (as in brick-and-mortar as opposed to Olivia Newton-John) has been trying to arrange its bookshelves to display more of the covers.
Much FACTA Legal Activity This Week, All In Retail's Favor
For those retailers worrying about the legal threats associated with the Fair and Accurate Credit Transactions Act (FACTA), in particular the rule that says they can't give a customer a receipt displaying the last few digits of the payment card nor can it show the expiration date, they can rest a lot easier this week. That's thanks to a ruling on Wednesday (May 28) from a federal judge and the passage of a bill this week softening the law.
Metro Using RFID To Track Meat Freshness
Germany's METRO Group is experimenting with RFID inserts to track meat and to immediately locate any product that is about to expire or that has expired. METRO is placing the inlays into the foam meat packing trays used in their Future Store.