Upto 5 million customers of Saks Fifth Avenue, Saks Off Fifth and Lord & Taylor may have had their credit data stolen after a cybercrime syndicate was found to be offering to sell the details.

Discovered by Gemini Data and announced today, the theft of the data is believed to have begun in May 2017 and may still be ongoing, with records stolen from stores in New York state, New Jersey and three locations in Canada. The syndicate was offering the data on the dark web, a shady part of the internet reachable through special software.

The hackers, identified as the JokerStash online crime syndicate, also known as Fin7, revealed their possession of the data on the dark web March 28. Initially they offered to sell only 125,000 records, with the rest likely to be offered for sale in the near future.

Fin7 has been linked to multiple retail hacks in the past including Whole Foods Market Inc., Chipotle Mexican Grill Inc. and Omni Hotels. Those were all point-of-sale systems hacks involving the infection of POS terminals with malware, and this is also the likely case here.

Dmitry Chorine, Gemini Data’s co-founder and chief technology officer, told the Guardian that he also suspects POS malware. “The hackers’ method was to send cleverly crafted phishing emails to company employees, especially managers, supervisors and other key decision-makers,” he said. “Once an employee clicks on [an] attachment, which is often made to look like an invoice, the system gets infected.”

Hudson Bay Co., the parent company of both Saks and Lord & Talyor, confirmed the hack in a statement Sunday. It said there’s no indication yet that this affects the company’s e-commerce or other digital platforms, Hudson’s Bay, Home Outfitters or HBC Europe.

“HBC wanted to reach out to customers quickly to assure them that they will not be liable for fraudulent charges that may result from this matter,” the company said. “HBC has identified the issue, and has taken steps to contain it. Once the company has more clarity around the facts, it will notify customers quickly and will offer those impacted free identity protection services, including credit and web monitoring.”

Photo: Wikimedia Commons