TALLAHASSEE, Fla. – Officials with Envision CU yesterday said they have been told a breach that forced them to reissue Visa credit and debit cards was the result of an electronic invasion of popular restaurant and gaming company Dave & Buster’s.
“Yes it is,” Al Hammock, a spokesman for the $200 million credit union, said yesterday.
The breach, announced last month by the U.S. Secret Service, has caused dozens of credit unions and banks to reissue cards. Envision CU has reissued a total of 612 Visa cards, including that of its president, Roy Cromer, according to Hammock.
The credit union’s president and CEO was one of two credit union employees whose accounts were unsuccessfully hacked. Cromer was in Orlando when Falcon Fraud Manager alerted the credit union of unusual activity on his account. When the credit union called Cromer’s home, his wife told them he was not in Oklahoma making $4,000 in purchases on his card, according to Hammock.
Envision originally was notified of 1,700 accounts potentially compromised but whittled it down to 612 after eliminating old and inactive accounts, said Hammock. “We did what we thought was the responsible thing to do and wrote all of the 612 members and told them what was going on,” Hammock told The Credit Union Journal.
Three foreign-based individuals last month were charged in a U.S. court with tapping into Dave & Buster’s from overseas by installing so-called packet sniffers over the Internet on the company’s computers. The packet sniffers were able to capture Track 2 cards data, including account numbers and PINs, as the transactions were being sent to the restaurant chain’s cards processor.
Officials with Dave & Buster’s did not return phone calls seeking comment.
One of the three defendants charged last month with the Dave & Buster’s breach was Maksym Yastremskiy, a well-known international trafficker in credit card information. Yastremskiy also is suspected of selling account data from the massive TJX breach. The 24-year-old Ukrainian was arrested a year ago in the Turkish resort city of Kemer.
Yastremskiy and his accomplices allegedly stole the Dave & Buster’s account information while overseas, then sold it to others who used it to make fraudulent purchases, causing losses to financial institutions.
