GoodWill Investigates Possible Data Breach; Secret Service Involved
Non-profit GoodWill Industries has stated they are working with U.S. Secret Service to investigate a possible data breach. Financial institutions around the country are tracking what they believe to be a series of hijacked credit cards that appear to be involved in GoodWill locations nationwide.
Centered in Rockville, Maryland, GoodWill Industries operates as a network of 165 independent organizations ranging throughout the United States, Canada, to 14 other countries. GoodWill is well known for taking donated items, selling them in their stores around the world, and using that money to help fund job training, employment placement services, and other community-based programs.
According to sources, GoodWill Industries stated on late Monday the company was contacted Friday by a payment card industry fraud investigative unit and federal authorities stating payment card numbers may have been compromised from stores ranging in the United States. The organization told KrebsOnSecurity it has not yet confirmed a breach, but is working with the Secret Service to investigate the matter. Brian Krebs stated GoodWill told him:
“Goodwill Industries International was contacted last Friday afternoon by a payment card industry fraud investigative unit and federal authorities informing us that select U.S. store locations may have been the victims of possible theft of payment card numbers,” the company wrote in an email.
“Investigators are currently reviewing available information,” the statement continued. “At this point, no breach has been confirmed but an investigation is underway. Goodwills across the country take the data of consumers seriously and their community well-being is our number one concern. Goodwill Industries International is working with industry contacts and the federal authorities on the investigation. We will remain appraised of the situation and will work proactively with any individual local Goodwill involved taking appropriate actions if a data compromise is uncovered.”
Krebs continues to note that the United States Secret Service did not response to his inquires.
The amount of locations and credit card data breached at GoodWill remains unknown, but the impact could be severe. GoodWill operates more than 2,900 stores and generates over $3.79 billion dollars annually in retail sales. Krebs sources say they have already traced fraud to 21 states that include Arkansas, California, Colorado, Florida, Georgia, Iowa, Illinois, Louisiana, Maryland, Minnesota, Mississippi, Missouri, New Jersey, Ohio, Oklahoma, Pennsylvania, South Carolina, Texas, Virginia, Washington and Wisconsin.
The amount of time this breach continued remains unknown, but Krebs financial industry sources say the breach could date back to the middle of 2013.
Data breaches have started to become a commonality among top retailers, just last month we saw the P.F. Changs data breach, alongside eBay, Michaela, Target, and other massive chains.
Sources:
KrebsOnSecurity
SeattleTimes
