BARNES & NOBLE BOOKSELLERS, INC.

Barnes & Noble Booksellers, Inc. experienced criminal tampering with 63 PIN pad devices across its US retail stores. American Express, the card issuer, notified affected cardholders that names, account numbers, and expiration dates may have been accessed. The incident was contained by September 14, 2012, when all affected devices were powered down. No Social Security numbers were impacted.

Barnes & Noble Booksellers, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-10-25. 14 Massachusetts residents were affected. The report records the breach type as electronic.

Barnes & Noble detected physical tampering with PIN pad devices in 63 retail stores across 9 states (CA, CT, FL, NJ, NY, IL, MA, PA, RI). Criminals planted bugs in the devices to capture credit/debit card numbers, names, and PINs. The company discontinued use of all PIN pads nationwide, notified federal law enforcement, and inspected all devices. No specific count of affected individuals was disclosed, but the incident affected fewer than 1% of pin pads. The member database and online systems were not compromised.

Barnes & Noble Booksellers, Inc. issued a breach notification to residents of New Hampshire, North Carolina, Maryland, and Massachusetts regarding unauthorized access to customer data. The notification includes FTC identity theft resources and state-specific AG contact information.