In a press release yesterday evening, retailer Eddie Bauer confirmed a point-of-sale malware infection suspected by some sources as early as beginning of last month. From the press release: “Eddie Bauer LLC today announced that its point of sale systems at retail stores were affected by malware, enabling unauthorized parties to access payment card information. Payment card information used for online purchases at eddiebauer.com was not affected. ... As part of the investigation, it was determined that customers’ payment card information used at Eddie Bauer retail stores on various dates between January 2, 2016 and July 17, 2016 may have been accessed. Not all cardholder transactions during this period were affected.”

— Company also reported that it has worked closely with the FBI, cyber security experts, and payment card organizations, and has assured customers that it has fully identified and contained the incident.

— “The acknowledgement comes nearly six weeks after KrebsOnSecurity first notified the clothier about a possible intrusion at stores nationwide,” reports Brian Krebs in a blog post on Thursday: “On July 5, 2016, KrebsOnSecurity reached out to Bellevue, Wash., based Eddie Bauer after hearing from several sources who work in fighting fraud at U.S. financial institutions. All of those sources said they’d identified a pattern of fraud on customer cards that had just one thing in common: They were all recently used at some of Eddie Bauer’s 350+ locations in the U.S. The sources said the fraud appeared to stretch back to at least January 2016.”

— “Given the volume of point-0f-sale malware attacks on retailers and hospitality firms in recent months, it would be nice if each one of these breach disclosures didn’t look and sound exactly the same. ... breached entities could offer the cyber defenders of the world just a few details about the attack tools and online staging grounds the intruders used ... [t]hat way, other companies could use the information to find out if they are similarly victimized and to stop the bleeding of customer card data as quickly as possible.” –Krebs