Staples Says Data Breach Affected 1.16 Mln Cards

(RTTNews) - Staples, Inc. (SPLS) announced on Friday that its data security experts have detected that criminals deployed malware to some point-of-sale systems at 115 of its more than 1,400 U.S. retail stores. The investigation found that hacking started in July in few of its stores and that approximately 1.16 million payment cards may have been affected.

Staples said it immediately took action, upon detection, to eradicate the malware in mid-September and to further enhance its security and also retained outside data security experts to investigate the incident. The company said it has worked closely with payment card companies and law enforcement on this matter.

Based on its investigation, Staples believes that malware may have allowed access to some transaction data at affected stores, including cardholder names, payment card numbers, expiration dates, and card verification codes. At 113 stores, the malware may have allowed access to this data for purchases made from August 10, 2014 through September 16, 2014 and at two stores, the malware may have allowed access to data from purchases made from July 20, 2014 through September 16, 2014.

Staples said it is offering free identity protection services to customers who used a payment card at any of the affected stores during the relevant time periods.

Staples said it has also received reports of fraudulent payment card use related to four stores in Manhattan, New York at various times from April through September 2014. But, the investigation found no malware or suspicious activity related to the payment systems at those stores.

In response, the cmpany said it has taken steps to enhance the security of its point-of-sale systems, including the use of new encryption tools.

Staples is the latest victim of the hacking, while Home Depot (HD) was affected in the mid of the year.

SPLS closed Friday's regular trading session at $17.55.