Going into the holiday season, hackers are ramping up their efforts to attack retailers and other businesses with point-of-sale malware.
BackOff, which is one of the most effective strands of PoS malware and is undetectable by most anti-virus software, saw a huge spike in the third quarter.
BackOff infections increased 57 percent in August and 27 percent in September, according to a report Friday by the security firm Damballa. And it's likely cybercriminals will only scale up their activity as the holiday season approaches, said Brian Foster, Damballa's chief technology officer.
"The threat actors are going to be burning the midnight oil trying to get credit card data going into the holiday season," Foster said. "Retailers need to be prepared and diligent in the fourth quarter."
But retailers haven't exactly had the best track record when it comes to keeping their customers' financial data safe.
Last November, just two day before Black Friday, hackers gained access to Target's point of sale systems and within a month were able to steal 40 million credit and debit card records. Since then, the number of businesses and scale of breach has only continued to grow.
In September, Home Depot said that some 56 million customers had their payment information stolen over a five-month period. Not long after Dairy Queen, Jimmy Johns and Kmart, a subsidiary of Sears, also reported breaches.
The BackOff malware is to blame for many of the recent PoS breaches.
In fact, more than 1,000 businesses have been infected with BackOff, according to the Department of Homeland Security.
And because it goes undetected by traditional anti-virus software BackOff continues to be a popular weapon among cybercriminals, Foster said.
But just because it is difficult to prevent BackOff from infecting retailers' payment systems doesn't mean retailers and other businesses are helpless against the malware, he added.
Besides just using preventative measures such as anti-virus software, businesses should also be using tools to monitor their network traffic to spot potential threats that have already entered their systems so that they can quickly respond, Foster said.
"A company just using anti-virus is doing below the minimum," he said. "Prevention is never going to be 100 percent. They need to start detecting what and where the threats already are."
