News
Security breach at Equifax compromises Kroger exmployee social security numbers, dates of birth
May 2016 by
News broke over the weekend that grocery giant Kroger had sent an email to current and former employees, indicating that their Social Security numbers and dates of birth may be compromised. The extent of the breach is not yet known, according to the email. It is believed the employee information was accessed via a security breach at Equifax. The grocery giant has a total of about 400,000 employees and nearly $110 billion in sales, according to its website.
Alex Cruz Farmer, VP of cloud, NSFOCUS IB:
"This is a huge blow for consumer trust. There has already been significant concern demonstrated with the growing amount of data which is now seemingly more accessible. Businesses who provide key online services like this have to be smarter about data loss prevention. Simple Web Application Firewalls are clearly not enough. Whilst I am sure Equifax have been vigilant, and have certified security standards, it clearly shows that the attackers are agile and are able to combat traditional perimeter security standards. For affected consumers, it’s extremely important to be monitoring your credit reports, and also changing any passwords and related PIN numbers which could have been compromised."
Mark Bower, global director, product management, HPE Security - Data Security:
"Organisations are getting the message that they need to protect customer data. However, this is an important lesson to realise they also need to guard their employees Personally Identifiable Information (PII) just as closely. Choosing the right data protection method is critical to mitigate today’s sophisticated attackers. Even with traditional data security systems in place, organisations have to ensure that when attacks occur – and they will – that security and data-level protection controls can’t be bypassed allowing recovery and access clear data. Today’s exploitations require organisations to look at securing data across all channels on a data-centric basis – from mobile apps, web apps, into and out of database, mission critical platforms and big data. Approaches that don’t discriminate between trusted users and attackers, such as transparent data protection methods, perimeter security tools or data at rest only protection will be open to exploitation – transparent to systems and data flows also means transparent to attackers”
