Neiman Marcus Hackers Set Off 60,000 Alerts While Bagging Credit Card Data
The hackers who raided the credit-card payment system of Neiman Marcus Group Ltd. set off alerts on the company's security systems about 60,000 times as they slunk through the network, according to an internal company investigation.
Context & Ripple Effects
Neiman Marcus's breach has been public knowledge for six weeks: Krebs on Security broke the card-theft story on January 11, and the New York Times followed on January 17 with the detail that intruders had been inside since July before containment. What was missing was an explanation for how a luxury retailer missed a months-long occupation.
Businessweek's answer reframes the failure: the company's own investigation found its security systems flagged the intruders roughly 60,000 times. The problem was never absent telemetry — it was that no one acted on the signal. That lands squarely on the question raised by Wired's January look at how Target ignored warnings years earlier, which argued big-box retailers treat alarm noise as background rather than as incidents.
First-order effects
- Neiman Marcus now has to explain publicly why ~60,000 alerts went unactioned while card data left the network, converting a technical failure into a governance failure its board and customers can see.
- Cardholders whose data moved through the compromised payment system remain exposed to counterfeit-card fraud until issuers reissue or block the stolen numbers.
Second-order effects
- Every retailer hit in the same 2013 holiday-season campaign — Target foremost among named peers — now faces the same audit question from regulators, banks, and customers: what did our own consoles log that nobody read?
- Banks and card networks absorb reissuance and fraud costs first, sharpening their incentive to push merchants toward chip-and-PIN authentication that makes skimmed magnetic-strip data worthless.
Third-order effects
- If alert volume this large routinely goes unread, the retail-security market shifts value from generating more detections to staffing and automating the response loop — monitoring-as-a-service and incident-response retainers over point products.
- A pattern of documented, logged-but-ignored breaches strengthens the case for mandatory disclosure timelines and merchant liability rules, since the evidence trail now shows retailers knew and did not act.
The trend: Retail breach forensics in 2014 is exposing a systemic gap between detection capability and operational response, turning security failures into boardroom accountability issues.