Stop that Thief

Earlier this year, a cyber criminal sneaked "malware"—malicious software—onto the servers of nearly 300 grocery stores operated by Hannaford Brothers Cos. When customers swiped their cards at the checkout counter, their financial data was snatched and sent overseas, where counterfeit credit cards were made and distributed. Hannaford is a sister company of Sweetbay, and the two share IT systems, so Sweetbay’s customers might have been affected by the massive breach.

Hannaford reported at least 2,000 cases of fraud, but up to 4.2 million credit and debit card accounts could have been compromised in six states between Dec. 7, 2007, and March 10, 2008. The company, as well as the Secret Service, is currently investigating just how the software was installed.

Had this happened to your business, would you know how to respond? You’d better by November, because it’s going to be the law. New "Red Flag Rules" will be enacted mandating that businesses have an identity-theft prevention program in place. Non-compliance could get you fines and civil action.

So let’s talk Red Flag Compliance 101.

The rules are the implementation of the Fair and Accurate Credit Transactions of 2003. Established by the Federal Trade Commission (FTC) and the federal financial institution regulatory agencies, Red Flag Rules require all businesses that extend credit to create and implement a program to prevent identity theft. Here are essential components of the program: