Malware found on the payment systems of Neiman Marcus led to the compromise of card data for an undisclosed number of shoppers, but PIN data is not at risk because the retailer does not use PIN pads in its stores, the company CEO said on Thursday.
Customers impacted in the breach are being notified, Karen Katz, CEO with Neiman Marcus, said in a Thursday statement emailed to SCMagazine.com and posted on the retailer's website.
SCMagazine.com inquired on Thursday as to the number of cards compromised in the data theft and asked for additional details on the malware infection of the company's payment systems, but Ginger Reeder, vice president of communications with Neiman Marcus, said that criminal and forensic investigations are still ongoing.
“Actions we have taken include working with federal law enforcement, disabling the malware we have found, enhancing our security tools, and assessing and reinforcing our related payment card systems in light of this new threat,” Katz wrote.
Neiman was informed in mid-December 2013 of unauthorized payment card activity linked to customer purchases in its stores, according to the statement, which adds that a forensic investigator confirmed on Jan. 1 that a “cyber-security intrusion” had occurred.
Neiman Marcus is offering one free year of credit monitoring services to any customer who shopped with the retailer in the past year. More details about that program are scheduled to be made available on Jan. 24.
A class-action complaint was filed against Neiman Marcus on Jan. 13, which seeks equitable relief for all impacted individuals.
