Pierluigi Paganini February 17, 2015

Jefferson National Parks Association discloses POS breach at Gateway Arch stores caused by a malware infection of the payments systems.

Jefferson National Parks Association announced on Friday about malware found on Point-of-Sale (POS) Systems deployed by two gift shops named Gateway Arch located in St. Louis. So far, it has been confirmed that most of the Credit card details are compromised while using credit cards on compromised Point-of-Sale (POS) systems. Information like Credit Card Names, Credit Card Numbers, and Credit Cards expiration dates was hampered with the PoS Malware.

In time I’m writing the Jefferson National Parks Association was unable to specify exact number of credit cards being compromised.

Jefferson National Parks Association responded to this incident immediately by suspending the use of its networked payment systems. The malware has been deactivated from Point-of-sale (POS) systems, by covering & deleting all possible payloads off the systems and instead, stand-alone payment processing system is now being used to continue their business operations. The investigation on the incident is still in progress.

On Dec. 17, 2014, Jefferson National Parks Association was informed by federal authorities about potentially compromised Point-of-Sale (POS) systems. The malware appears to be most active during early August 2014 to Dec. 17, 2014, to steal credit cards details through compromised Point-of-Sale (POS) Systems. The malware was installed before November 2013, when the Point-of-Sale (POS) systems were physically located at other sites: the Old Courthouse and U.S. Grant National Historic Site.

“The method of malware infection is unclear. Investigators believe that the malware may have been installed as early as November 2013, when these terminals were physically located at other sites, specifically the Old Courthouse and U.S. Grant National Historic Site.”

Other payments at the Arch, including tram and movie ticketing, and riverboat excursions, are not affected. Online purchases and donations made at the Jefferson National Parks Association website are not affected. Other personal information – such as addresses CVVs and PINs – was not captured because that information is not collected. The method of malware infection is still unclear.

 “We took immediate steps to address this unfortunate issue and conduct a thorough investigation,” David Grove, president and CEO of Jefferson National Parks Association, was quoted as saying in a notification posted to the Jefferson National Parks Association website.

Author Rahil Karedia

“Rahil Karedia” is a Security Writer & Security Researcher, since last 3 years and actively helping out “Indian Law Enforcement Agencies”, “Data Security Council of India” and “(ISC)2 Delhi Chapter” to better beat Cyber Crime, Globally.

Published by Pierluigi Paganini

(Security Affairs –  PoS malware, cybercrime)