Forever 21 becomes the latest retail chain to suffer a security breach

Over the past several years we have seen a multitude of security problems plague major retail stores around the world. Breaches have come in many forms and have frequently targeted credit card information, though in some cases personal data has been part of the haul.

Now we find ourselves looking at yet another incident. Retail chain Forever 21, which is wildly popular among young people in the United States -- you can barely find a mall that doesn't have one -- has officially announced that its systems were compromised.

The extent of the damage is not fully known as of yet. The company posted a brief statement on its website to warn its customers. It seems to downplay the breach to a certain extent, claiming it boosted security back in 2015, but that some stores hadn't yet been brought up to speed. This resulted in point-of-sale attacks at certain locations. The investigation is focusing on transactions between March and October of this year.

This isn't new -- security researcher Graham Cluley points out "Back in 2008, the US Department of Justice charged a gang that stole hundreds of millions of shoppers’ credit card details from major retailers including TJ Maxx, Barnes & Noble, Boston Market, and Forever 21."

Sophos gives a brief explanation, in layman's terms, of PoS: "You swipe your card when you buy a t-shirt, gas up your car, or whatever else you do with your plastic. Then your sensitive (hopefully) encrypted payment data gets fed into a Point-of-Sale (PoS) system, decrypted in the PoS's RAM for processing, and you’re good to go. Except when you’re not." The security firm goes on to point out one such popular mechanism for attack, a program known as Citadel which uses screen capture and keylogging. Others, such as Trackr, scrape the RAM.

For now, pending more information, it seems prudent to follow the advice of Forever 21 and keep a careful eye on your card activity.