PhysicalRetail & ConsumerRetailTamperingCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

BARNES & NOBLE BOOKSELLERS, INC.

bd_bb25a24a77ddb56e · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 24, 2012

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for BARNES & NOBLE BOOKSELLERS, INC. →2 incidents on file

Barnes & Noble detected physical tampering with PIN pad devices in 63 retail stores across 9 states (CA, CT, FL, NJ, NY, IL, MA, PA, RI). Criminals planted bugs in the devices to capture credit/debit card numbers, names, and PINs. The company discontinued use of all PIN pads nationwide, notified federal law enforcement, and inspected all devices. No specific count of affected individuals was disclosed, but the incident affected fewer than 1% of pin pads. The member database and online systems were not compromised.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Oct 24, 2012

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_ef12ddb62245fd5f2012-10-24Verified
Massachusetts State AGbd_3c60c7b3159f8b322012-10-25 · +1dVerified

Name: BARNES & NOBLE BOOKSELLERS, INC.
norm: barnes noble booksellers

Name: BARNES & NOBLE BOOKSELLERS, INC.
norm: barnes noble booksellers
Industry: Retail & Consumerllm

Discovered: —
Materiality determined: —
Notification sent: Oct 24, 2012
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement authoritiesSupporting a federal government investigation into the matter

During the incident: Discontinued the use of all PIN pads in its nearly 700 retail stores nationwide
Informed federal law enforcement authorities
Began a thorough internal review involving the inspection of every PIN pad in every store
Cooperating with federal law enforcement in this matter
Working with banks, payment card brands and issuers to identify accounts that may have been compromised
Removed all PIN pads from our retail stores
Changes made: Implementing additional security measures designed to prevent a recurrence of such PIN pad tampering
Removed all PIN pads from our retail stores
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 24 · first

California State AGOct 24 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-36794
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2012
Raw hash: d6a79bfb525c63d2e4c3bd8c73eb610533c56dd798bec30610778bd4de82e22c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBARNES & NOBLE BOOKSELLERS, INC.

Victim entityBARNES & NOBLE BOOKSELLERS, INC.

IncidentUnknown

Stated responseDiscontinued the use of all PIN pads in its nearly 700 retail stores nationwide

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov