Neiman Marcus was in the news a few years ago with a customer payment card breach, and now they’re back with another breach. Neiman’s says this is not related and, this time, customer account data was accessed through compromised online account passwords:

Commenting on this, George Rice, senior director, payments at HPE Security - Data Security. said: “Data thieves are highly effective at finding weak points in security strategies. This may be a case where in its effort to plug other security holes, the business was unable to focus on necessary enhancements to the security of online customer access. Protecting the sensitive data within their online environment could have avoided this data loss. There’s simply no excuse today not to follow best practices of encrypting all sensitive personal and financial data as it enters a system, at rest, in use and in motion. The ability to render data useless if lost or stolen, through data-centric encryption and tokenization, is an essential benefit to ensure data remains secure. Many retailers have already adopted technologies that do just that, providing a proven, reliable way to also protect customer trust and satisfaction.

Cyber criminals today are motivated to steal enterprise data, intellectual property and employee or customer information. Hackers are always looking for a way to exploit a system in a way that they can then turn stolen data into cold, hard cash. There is a definite risk if credit card or account information is obtained. However businesses need to also think about protecting personal information about their customers like name, full address, phone number and email address. Criminals could then use this information to open bogus accounts or sell it for use in more targeted larger-scale spear-phishing or identity theft attacks.

Beyond the threat to sensitive data, companies need to be concerned with the impact such an event can have on their reputation and, ultimately, on their bottom line. A data-centric approach to security is the industry-accepted cornerstone needed to allow companies to mitigate the risk and impact of cyber attacks and other attempts to get this information.”