Hackers Steal Card Data from Neiman Marcus
Responding to inquiries about a possible data breach involving customer credit and debit card information, upscale retailer Neiman Marcus acknowledged today that it is working with the U.S. Secret Service to investigate a hacker break-in that has exposed an unknown number of customer cards.
Context & Ripple Effects
This lands less than a month after Krebs on Security first reported Target was investigating a data breach in December 2013, a story that metastasized into one of the largest card compromises on record — by January 11 the same outlets chasing the Neiman Marcus acknowledgment were also updating Target's exposure figures past 100 million customers.
The pattern is now two-for-two among national retailers in a single holiday season: an upscale chain confirming a hacker break-in and card exposure while working with the U.S. Secret Service mirrors exactly the posture Target took when its investigation surfaced, suggesting investigators are following one intrusion crew across multiple victims rather than treating these as isolated incidents.
First-order effects
- Customers who used credit or debit cards at Neiman Marcus stores face immediate fraud exposure on unknown numbers of accounts, and issuing banks bear the near-term cost of monitoring and reissuing compromised cards.
- Neiman Marcus shifts from denial mode to incident response, with the Secret Service involved and disclosure scope — how many cards, over what window — still undefined.
Second-order effects
- Every major retailer with point-of-sale infrastructure now faces board-level pressure to audit its own systems for the same intrusion pattern, since two breaches in six weeks implies a shared attack method rather than bad luck at two companies.
- Card networks and issuers absorb escalating reissue and fraud-liability costs from back-to-back retail compromises, sharpening their incentive to push merchants toward more secure payment authentication in the US market.
Third-order effects
- If the pattern holds, the 2013–14 holiday season becomes the forcing event that moves the long-stalled US migration away from magnetic-strip cards, with liability shifting toward whichever party in the transaction chain uses the weaker technology.
- Retail breach disclosure is being normalized as a federal-investigation-assisted event rather than a voluntary announcement, changing how chains sequence legal exposure against customer notification going forward.
The trend: Point-of-sale intrusions at major US retailers are clustering into a campaign-level threat, accelerating the payments industry's push to retire magnetic-strip cards.