(CNN) - A security firm that had pointed the finger at a 17-year-old Russian last week updated its report Monday to identify a different Russian resident as being responsible for writing the malware used in an attack compromised the credit card numbers and other personal information of up to 110 million Target customers.
In a statement published Friday, security firm IntelCrawler said the breach was the result of malware that infected Target's payment system and possibly compromised the systems of other retailers. Neiman Marcus reported a similar security breach this month.
The 17-year old does not appear to be solely responsible for the attack. Independent security researcher Brian Krebs earlier reported that other code in the Target hack pointed to a Ukraine resident.
Experts say the author may have shared it with others.
"Well, we should be worried. One of the things the hackers do is take the malware as it's called. Once it's identified, then the security community can rally around it and put controls in place. But the problem is, the hackers know that. And they manipulate or mutate this malware, and then reuse it," SecureState CEO Ken Stasiak said.
"We believe that he originated the code, or the malware everybody's calling it now. And was able to put it up on the Internet for download for other hackers to then take, and potentially use it for malicious harm. And that's what we believe happened to Target and Neiman Marcus."
The first sample of the malware was created in March and since then, more than 40 versions have been sold around the world, IntelCrawler said. It first infected retailers' systems in Australia, Canada and the United States.
Andrew Komarov, IntelCrawler CEO, said most of the victims are department stores and said more BlackPOS infections as well as new breaches could appear soon. Retailers should be prepared.
"The numbers could be staggering, really, because what the retailers are looking at are potential class action lawsuits," CNN legal analyst Paul Callan said.
"Let's say hypothetically, a retailer has 40 million transactions by 40 million different customers. All 40 million may have been damaged in some way, and under law they can all be joined together in a class action lawsuit."
Wednesday, April 23 2014 8:20 AM EDT2014-04-23 12:20:28 GMT
The family of a little boy paralyzed after a gas station shooting that killed his father has added a stranger to the ranks of their family because of what she did for the 10-year-old boy. The woman doesn'tMore >
The family of a little boy paralyzed after a gas station shooting that killed his father has added a stranger to the ranks of their family because of what she did for the 10-year-old boy.More >
Wednesday, April 23 2014 9:54 AM EDT2014-04-23 13:54:24 GMT
A family is grieving, but shock and loss for words came when hearing the driver that killed at Northland father was drunk, police say. Court records show 20-year-old Joseph C. Surratt, who caused theMore >
A family is grieving, but shock and loss for words came when hearing the driver that killed at Northland father was drunk, police say.More >
Tuesday, April 22 2014 8:47 PM EDT2014-04-23 00:47:34 GMT
A duck with "dangerous propensities" is at the center of a $275,000 lawsuit. The lawsuit was filed Tuesday in Clackamas County. It claims the plaintiff, Cynthia Ruddell, stepped out of her motorhomeMore >
The lawsuit claims the duck has a history of attacking people and its owner was negligent for failing to maintain proper control of her animal.More >
Tuesday, April 22 2014 10:59 PM EDT2014-04-23 02:59:07 GMT
Parents at Children's Mercy Hospitals were greeted Tuesday with a new "No Hit Zone". It's an anti-spanking initiative being practiced in only a handful of hospitals in the country. "We want parents toMore >
Parents at Children's Mercy Hospitals were greeted Tuesday with a new "No Hit Zone". It's an anti-spanking initiative being practiced in only a handful of hospitals in the country.More >
Tuesday, April 22 2014 5:56 PM EDT2014-04-22 21:56:02 GMT
A 45-year-old Kansas City man has died from his injuries after a head-on crash in the Northland.More >
A 45-year-old Kansas City man has died from his injuries after a head-on crash in the Northland. A Lee's Summit man is accused of driving with a blood-alcohol level more than three times the legal limit when he caused the crash. More >
Wednesday, April 23 2014 11:25 AM EDT2014-04-23 15:25:18 GMT
A new airline is going to take off at Kansas City International Airport.Officials have scheduled a news conference for 10 a.m. Wednesday to "make a major announcement about new air service" at the airport.More >
A new airline is going to take off at Kansas City International Airport. Spirit Airlines is now allowing passengers to book flights to and from KCI.More >