By Tom Brant,
Russian cybercriminals appear to have breached more than 330,000 cash registers at fast food chains, retail stores, and hotels around the world, according to security experts.
The hackers’ target was a network of point-of-sale systems manufactured by Micros, which Oracle acquired in 2014, security researcher Brian Krebs wrote in a blog post today.
Oracle confirmed the hack, telling Krebs in a statement that it had “detected and addressed malicious code in certain legacy Micros systems.” The vulnerability originated in Micros’ customer support portal, which Oracle uses to help customers remotely troubleshoot problems with their point-of-sale devices.
Citing sources familiar with Oracle’s investigation, Krebs wrote that the company is still trying to determine the scale of the breach. It’s unclear when the attack first started, or whether any consumers’ financial data was stolen. The investigation did uncover a data link between the Micros support portal and a server known to be used by the Carbanak group, a Russian cybercrime syndicate.
“This breach could be little more than a nasty malware outbreak at Oracle,” Krebs wrote. “However, the Carbanak Gang’s apparent involvement makes it unlikely the attackers somehow failed to grasp the enormity of access and power that control over the Micros support portal would grant them.”
An Oracle spokesperson did not immediately respond to a request for comment.
The company has come under fire in the past for its response to other hacking incidents. Last fall, it settled with the Federal Trade Commission over charges that it deceived consumers about the security of updates to the Java application platform, which it owns.