Grocery terminals slurped payment card data

Two months undetected

Grocery chain Aldi Inc. has warned customers in 11 states that their payment card data may have been slurped up by point-of-sale terminals that were illegally planted by identity thieves.

The tampered terminals were in use from June 1 to August 31 in an undisclosed number of stores, the company disclosed in a press release (PDF) that appeared on a Friday, a favorite day of the week for releasing bad news. As many as 1,000 Aldi shoppers in Illinois and Indianapolis have already reported fraudulent charges, according to Computer World.

The breach is noteworthy for the breadth of the affected geography, which spanned from New York state to Georgia to as far west as Illinois. Presumably, those responsible would have had to travel to each store to physically plant the hardware used to siphon personal identification numbers, card numbers and names.

PINs are generally encrypted as they pass from the terminal to the payment processor, so they have to be captured using cameras or keyboard overlays that capture the secret code before it's encrypted.

Aldi, which has about 1,100 stores in 31 states, said it believes all the tampered terminals have been removed. ®