(CNN) - A security firm that had pointed the finger at a 17-year-old Russian last week updated its report Monday to identify a different Russian resident as being responsible for writing the malware used in an attack compromised the credit card numbers and other personal information of up to 110 million Target customers.
In a statement published Friday, security firm IntelCrawler said the breach was the result of malware that infected Target's payment system and possibly compromised the systems of other retailers. Neiman Marcus reported a similar security breach this month.
The 17-year old does not appear to be solely responsible for the attack. Independent security researcher Brian Krebs earlier reported that other code in the Target hack pointed to a Ukraine resident.
Experts say the author may have shared it with others.
"Well, we should be worried. One of the things the hackers do is take the malware as it's called. Once it's identified, then the security community can rally around it and put controls in place. But the problem is, the hackers know that. And they manipulate or mutate this malware, and then reuse it," SecureState CEO Ken Stasiak said.
"We believe that he originated the code, or the malware everybody's calling it now. And was able to put it up on the Internet for download for other hackers to then take, and potentially use it for malicious harm. And that's what we believe happened to Target and Neiman Marcus."
The first sample of the malware was created in March and since then, more than 40 versions have been sold around the world, IntelCrawler said. It first infected retailers' systems in Australia, Canada and the United States.
Andrew Komarov, IntelCrawler CEO, said most of the victims are department stores and said more BlackPOS infections as well as new breaches could appear soon. Retailers should be prepared.
"The numbers could be staggering, really, because what the retailers are looking at are potential class action lawsuits," CNN legal analyst Paul Callan said.
"Let's say hypothetically, a retailer has 40 million transactions by 40 million different customers. All 40 million may have been damaged in some way, and under law they can all be joined together in a class action lawsuit."
Wednesday, March 12 2014 8:39 AM EDT2014-03-12 12:39:02 GMT
A local landlord and tattoo shop owner is suspected of a disturbing surveillance scheme involving one of his tenants. The cameras were disguised as smoke detectors. When police unscrewed them, they foundMore >
A local landlord and tattoo shop owner is suspected of a disturbing surveillance scheme involving one of his tenants.More >
Tuesday, March 11 2014 8:51 PM EDT2014-03-12 00:51:58 GMT
By DAVE SKRETTAAP Sports Writer KANSAS CITY, Mo. (AP) -- As the first hour of free agency came to a close Tuesday, the flood of players headed out of Arrowhead Stadium for big-money deals had finallyMore >
As the first hour of free agency came to a close Tuesday, the flood of players headed out of Arrowhead Stadium for big-money deals had finally slowed to a stop.More >
Tuesday, March 11 2014 8:26 PM EDT2014-03-12 00:26:17 GMT
Residents of the quiet town of Excelsior Springs are on edge Tuesday after a woman was brutally attacked inside her home Monday.More >
An Excelsior Springs woman fought off a brutal attack and took actions that allowed a passing motorist to come to her aid. Neighbors say police searched the home of a middle schooler in connection with the attack. More >
Prosecutors are expected to present evidence in the capital murder case against a 28-year-old man accused of killing three adults and a child at an eastern Kansas farm.More >
Nearly 8 hours of testimony was heard Tuesday about the events that led to Kyle Flack being accused of killing four people, including an 18-month-old girl whose body was found stuffed in a suitcase tossed into a creek. More >
Wednesday, March 12 2014 2:33 PM EDT2014-03-12 18:33:12 GMT
Authorities are investigating a possible homicide in rural Platte County Tuesday.The Platte County Sheriff's Department said they are at the 18000 block of Interurban Road in Platte City, MO.The sheriff'sMore >
Authorities are investigating the possible homicide of a 56-year-old Platte County man.More >
Wednesday, March 12 2014 8:37 AM EDT2014-03-12 12:37:35 GMT
For a child stuck in a hospital room for six months, getting online can be one of their only escapes. Now, a Raytown 14-year-old is using that same tool to try to make his court-side dreams come true. MarcelMore >
For a child stuck in a hospital room for six months, getting online can be one of their only escapes. Now, a Raytown 14-year-old is using that same tool to try to make his court-side dreams come true.More >