12/2/19

LP, AP & IT Security's #1 News Source

eBay's Global AP/PROACT Team at NRF Protect 2019
 

From left to right: Christian Hardman, Hawken Averett, Stephen Huhnke, Spencer Jones

eBay's Global Asset Protection/PROACT team was present at NRF in Anaheim this year, as part of a tradition that eBay has maintained to ensure our involvement in relation to combatting ORC, strengthening relationships with law enforcement and retail partners, and promoting eBay's PROACT program. As we have for the past several years, eBay also sponsored the Fusion Center, and maintained a booth there to continue fostering relationships between public and private partnerships.

For further information on PROACT, email inquiries to PROACT@eBay.com.

Leftovers

As I'm still recovering from Thanksgiving weekend which included endless amounts of turkey, potatoes and desserts I thought that writing about the importance of "leftovers" would be fitting. The dramatic event of a Thanksgiving dinner is the highlight of the weekend (and a few football games), but I think most would agree that leftovers from that meal are on another level. Now this may be a stretch (similar to the pants I prefer to wear on Thanksgiving day), but I think we can compare an investigative interview to this illustrious meal. The preparation and planning, the stress and drama, the awkward feeling at the end when nobody is sure when to leave - all direct translations. Truth be told, I think the leftovers of an interview are often underappreciated.

Let's take a look at what's still in the fridge after the interview took place: Read more here

Joker's Stash Advertises More Stolen Payment Card Data
Tis The Season - Bad Cards Hitting the Market Just in Time for Xmas
4 Million Stolen Cards Hitting the Market
Carder Forum Listing Appears Tied to Breaches at Four Restaurant Chains

A new batch of stolen payment card data has appeared on the notorious Joker's Stash underground marketplace. The new listing appears related to breaches at four different restaurant chains in the U.S. over the last several months, according to a security analysis published this week.

The new breach listing, dubbed "New World Order," first appeared on the Joker's Stash marketplace on Nov. 22, and the batch of data appears to include credit and debit card data stolen from four different restaurant chains that include fast-food chain Krystal, Moe's Southwest Grill, McAlister's Deli, and Schlotzsky's, according to the analysis by Gemini Advisory, which tracks stolen payment card data.

One reason that this new listing may have appeared at the end of November is that its coinciding with the holiday shopping season, which starts on Black Friday, Nov. 29. Alforov notes that cybercriminals might be looking for new batches of stolen payment card data in order to take advantage of this burst of commercial activity.

In previous reports, other security researchers find that Joker's Stash remains one of the major underground sites specializing in the sale of stolen payment card data. These security analysts have also come across large data dumps periodically on the forum.

How much stolen credit card is now for sale on Joker's Stash remains in dispute. Security blogger Brian Krebs, who first reported the new batch of payment card data, writes that there are at least 4 million credit and debit card numbers for sale on the underground forum. bankinfosecurity.asia

New US Federal Privacy Bill Proposed
Legislation Designed Along the Same Lines as CCPA

U.S. Sen. Maria Cantwell, D-Wash., has introduced federal privacy bill called the Consumer Online Privacy Rights Act, or COPRA, which would expand the rights of people when it comes to how personal data is collected, shared and used. Senators Amy Klobuchar, D-Minn..; Ed Markey D-Mass.; and Brian Schatz, D-Hawaii, co-sponsored the bill.

"Privacy rights should be like your Miranda rights-clear as a bell as to what they are and what constitutes a violation," Cantwell said in a statement. The bill received statement of support from privacy advocacy groups, such as Consumer Reports, the Electronic Privacy Information Center (EPIC), and the Georgetown Law Center on Privacy & Technology.

According to data available with National Conference of State Legislatures there are about 110 privacy bills pending for various states in the U.S.

As proposed, COPRA has broad applicability to businesses, individuals and personal data across the United States. The proposed bill excludes small businesses with revenue of less than $25 million per year. Companies who are deriving less than 50% of their revenue from transferring covered data for valuable consideration would also be unaffected.

COPRA has designed rights for citizens much the same way as the CCPA, with a few additions. govinfosecurity.com

Here Comes DPO's - Data Protection Officers
How to Get Prepared for Privacy Legislation
Getting privacy basics right is a solid foundation
On January 1, 2020, California will step on the world stage of privacy when the California Consumer Privacy Act (CCPA) takes effect. It follows the European Union's General Data Protection Regulation (GDPR) and other regional legislative controls that are designed to protect the personal data of consumers.

There may be requirements to update privacy policies, third-party, and service provider contracts and any other terms that cover the collection, retention, and protection of personal data held by the company. It's important that all businesses review their status and establish if they need to comply with the legislation.

As with other privacy legislation, the fines for noncompliance could be significant. Under GDPR, we have recently witnessed British Airways being fined $230 million and Marriott Hotel Group $123 million for data breaches. The CCPA legislation allows for fines by the attorney general of up to $7,500 per incident and gives individual consumers the right to file a lawsuit for up to $700 each. I expect once the legislation takes effect that we will see some considerable legal action with class action lawsuits filed against companies that suffer data breaches

Complying with the legislation requires companies to adopt policies for the collection and retention of the data. It also requires companies to provide "reasonable security" to protect the personal data. darkreading.com

GDPR compliance benefits emerge a year and a half later
Correlation between compliance and improved security
Results from a Cisco survey indicated GDPR-compliant organizations are safer from breaches than noncompliant organizations: The percentage of GDPR-ready organizations affected by data breaches was 74% in 2018, compared to 89% of non-GDPR-ready companies. In addition, fewer records were affected, system downtime was shorter and monetary costs were lower in GDPR-ready organizations.

With data breach consequences ranging from fines to lost clients to public relations disasters, there are many reasons for businesses to focus on and prioritize GDPR compliance.

Many GDPR components can only help an organization's security posture. For example, mandates surrounding privileged access management, which audits user access to critical data, reduce the chances that high-risk privileged accounts become compromised. GDPR's 72-hour breach notification is also a considerable deterrent because it criminalizes cover-ups to force accountability. Additionally, GDPR mandates institutions that handle large amounts of sensitive data employ a data protection officer who is responsible for enforcing GDPR compliance along with the general data protection strategy of the organization. techtarget.com

Cyber Criminal Gang RAT busted by cops
A website that sold more than 14,500 copies of a remote access trojan (RAT) to cyber criminals in 124 countries has been taken down, and nine people arrested in the UK, following an international effort spearheaded by the UK's North West Regional Organized Crime Unit (NWROCU) with support from the National Crime Agency (NCA) and Australia's Federal Police force (AFP).

The Imminent Monitor RAT was sold for as little as $25 and gave full remote control of the endpoint if installed on a victim's computer, enabling cyber criminals to disable other cyber security protections, steal data or passwords, record keystrokes, and activate webcams. A total of 85 warrants were executed and 14 people taken into custody, with more than 400 pieces of equipment seized. computerweekly.com

U.S. Cyber Officials Give Holiday Shopping Advice for Consumers
 

Sensormatic Solutions Enabling Smart, Connected Shopper Engagement and Empowering Store Associates

Sensormatic, the brand synonymous with retail loss prevention, now offers innovative store performance solutions that help improve operations, optimize profitability and create memorable shopper experiences. Hear from their experts how Sensormatic's Shrink Management as a Service (SMaaS) empowers LP professionals to more strategically manage shrink with predictive analytics and shoplifting insights, and why Sensormatic's new InFuzion Tag is a gamechanger for the industry.

Quick Take 3 with The Zellman Group
 

Stuart Levine, CEO, The Zellman Group with MCs Joe LaRocca and Amber Bradley

Stuart Levine, CEO of The Zellman Group, talks about the changing landscape of civil recovery, reveals his misadventures with the GPS app Waze, and becomes the first contestant of the day to take on Amber's "Lightning Round" of hot-seat questions.
 

Cyber Monday poised to net record $9.4B in the US
Cyber Monday online sales globally are on pace to rise 12% above last year to $30 billion (from $26 billion last year), according to Salesforce research. In the U.S., the day's digital sales are expected to grow 15% year over year to $8 billion from $7 billion last year, according to the report.

Adobe Analytics, which measures transactions from 80 of 100 major U.S. online retailers, tops that, forecasting a new record of $9.4 billion in sales, an 18.9% increase over last year. By 9 a.m. Eastern time Cyber Monday, merchants had already done $473 million in online business, Adobe said. retaildive.com

Cyber Monday Stacks Up as a Battle Between Amazon & Everybody Else
Target, Walmart & Major Retailers Threaten Amazon
"The gap that Amazon had as an advantage over other retailers is starting to close," said Monisha De La Rocha, a partner at Bain & Company.

Amazon has become a huge threat to big-box stores in recent years, but those retailers may be making a comeback this Cyber Monday.

Walmart and Target had bigger jumps than Amazon in online customer spending during the first two weeks of November compared with the same period last year, according research firm Edison Trends, which looked at more than 1.2 million transactions. Walmart took in 51% more than last year, while Target followed close behind with a 47% increase. While Amazon only grew 32%.

The big stores are realizing they can compete with Amazon and win back market share. cnbc.com

3 Things Employers Should Consider On Cyber Monday
Over two-thirds of employees plan to shop online while at work during the holiday season. This means employers should have a plan to navigate the next few weeks to maintain productivity and minimize disruption. Here are three things employers should consider.

1. Online Shopping May Not Be a Big Deal
In reality, Cyber Monday may not be any different than an average day. Employees might already spend time on non-work-related Internet activities during their typical workday.
● Enforce productivity and quality standards on Cyber Monday - just as they would any other day - to ensure that online shopping does not sidetrack employees from completing their appointed work.
● Remind employees to avoid suspicious websites or applications to prevent potential data breaches.

2. Communication Is Crucial
Regardless of how employers choose to proceed, they should make sure that the organization's handbook and policies are in order. First, make sure the rules are provided to all employees. Have workers provide an electronic signature or signed acknowledgement page for their employee file as proof that they received a copy of the policies.

3. Consistency Is Key
As always, one of the best ways to avoid legal troubles is to be consistent with the enforcement of policies. Put another way, if an employer drops the hammer on one employee for breaking a specific rule, it must drop the hammer on any other employee that also breaks that same rule. shrm.org

Europol & US National IP Rights Coordination Center Seize 30,506 Domains
Distributing Counterfeit & Pirated Items in Operation IOS X (In Our Sites)
Law enforcement authorities from 18 EU Member States and third parties in a joint investigation with Europol and the US National Intellectual Property Rights Coordination Centre, facilitated by Eurojust and INTERPOL, have seized over 30,506 domain names that distributed counterfeit and pirated items over the internet during operation IOS X. These included counterfeit pharmaceuticals and pirated movies, illegal television streaming, music, software, electronics, and other bogus products. 

3 arrests and 26,000 luxury products seized. europa.eu

These 4 charts explain Amazon's fulfillment speed

Costco's website goes down on Thanksgiving, other retailers also see outages Friday
 

Lewisville, TX: $35,000 Worth of Compound Bows Stolen From Archery Store
The store was broken into early Friday morning, according to Lewisville Police. Video surveillance from the gun range next door to All Star Archery & Marine shows a white truck taking off just before 6 a.m. Police said the person or people responsible for the burglary were in the store for six minutes. nbcdfw.com

St. Petersburg, FL: 2 Florida Women Steal An Elderly Woman's Credit Card And Spend $5,000 Within half an hour, the two women went to a department store and bought the electronics and gift cards. The women also tried to purchase merchandise at another store, but the victim's credit cards were denied. The St. Petersburg Police released photos of the women obtained by security cameras on social media. One of the photos shows the two walking out of a store happily laughing with two bags filled with items. theinnersane.com

Long Grove, IL: 3 Chicago women lead police on chase following $2,500 Black Friday shoplifting, tasing incident
About 5:40 p.m. Friday, police were patrolling a retail shopping area on West Long Grove Road when a white car that was reported stolen drove past them, and the officers "recognized the occupants" from police bulletins detailing retail thefts in the Chicagoland area, according to the Lake County sheriff's office. The 18-year-old woman behind the wheel of the car, Jonva C. Vivetter would not stop when sheriff's deputies activated their lights and sirens and tried to pull her over, and officers began chasing them. Vivetter crashed into at least three cars, including a sheriff's squad car. After searching the car, police found about $2,500 worth of expensive perfume including Chanel, Ugg boots and several pieces of clothing, all believed to have been stolen, the statement said. courant.com

Hanover County, VA: Man wanted for stealing over $5,000 worth of chainsaws from James River Equipment

Oswego, IL: Police report $2,170 worth of perfume stolen

Mecosta County, MI: Three People Arrested for $1,000 Retail Fraud and Meth

San Antonio, TX: Man accused of swapping out prices on high-end wine bottles; resulting in the theft of thousands of dollars

Lawrence Township, NJ: Walmart thief steals $1,200 worth of iPhones, PlayStation 4 game consoles and Samsung Galaxy tablets

Oxnard, CA: Suspect charged with $420 Home Depot tool theft after brief foot pursuit; prior thefts
 

Click to enlarge map

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

 

	Regional Asset Protection Leader St. Louis, MO The Regional Asset Protection Leader is responsible for driving a low shrink and safety culture in a geographical area consisting of 235 ascena retail locations and approximately $400+M in revenue within the ascena family of brands. They develop, monitor and execute programs that create awareness around shrink, safety and integrity...
	Regional Loss Prevention Manager Greater Toronto Area, Canada Become the Newest Member of the VF Family. As the Regional Loss Prevention Manager, you will have the critical function to support an entire region of stores and serve as the subject matter expert in loss mitigation. You will have the great responsibility to own and oversee all matters and investigations of internal and external theft...
	Senior ORC Investigator Boca Raton, FL The Senior Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our customers. The Senior Investigator is responsible for assisting with implementing a strategy to combat organized retail crime and external theft across the TJMaxx and Marshalls brands...
	Loss Prevention Investigator Seattle, WA The Loss Prevention Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our internal and external customers. With a focus on internal cases, the Investigator takes complex investigations head-on through establishing solid partnerships with store and LP leadership...
	Loss Prevention Investigator San Jose, CA The Loss Prevention Investigator is part of a fast-growing, ever changing environment that partners with Store Operations to ensure we provide the best experience to our internal and external customers. With a focus on internal cases, the Investigator takes complex investigations head-on through establishing solid partnerships with store and LP leadership...
	Loss Prevention Operations Specialist Tucscon, AZ The Loss Prevention Specialist will oversee the Burglar/Fire Alarm and overall Physical Security function for stores including CCTV for all new stores, renovations, acquisitions, closing, existing stores and warehouses. In addition, this position supports the security/property control component for the Corporate Headquarters main campus...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here