The software company Oracle has become the latest victim of a Russian organized cybercriminals. The hackers have found a way to compromise the customer support portal for hundreds of Oracle’s MICROS point-of-sale (PoS) credit card payment systems.
Servicing over 330,000 cash registers, MICROS is one of the top PoS in the world. With the breach still being under investigation, it’s not entirely certain how long the gang had access to Oracle’s devices. It was originally believe that only a few systems were affected, but after installing new security tools, it became clear that the breach included more than 700 systems.
It’s believed that the Carbanak Gang is behind the intrusion due to the MICROS customer support portal communicating with a server used by the cybergang. Carbanak is part of a larger Russian organized crime syndicate that has stolen over a billion dollars from banks and retailers recently.
Many of the credit card breaches over the last several years, like the ones at Target and Home Depot, have been done using malware on PoS systems. Typically once hackers have compromised remote administrative tools, they can load their malicious code onto devices in order to steal swiped credit card data.
The intrusion into Oracle was likely not unlike those other intrusions with a single system being infected then spreading to others. One of the systems affected was the MICROS customer ticketing portal that allows customers to report and troubleshoot problems with their PoS devices. Once infected the attackers were able to steal the usernames and passwords of MICROS customers logging in to the support site.
Fortunately, according to Oracle MICROS encrypts credit card data when it is being sent and when it’s at rest. However, as a precaution Oracle is forcing all MIRCOS portal accounts to reset their passwords and are suggesting users do the same for anyone who has had access to on premises devices.