Barnes & Noble says thieves tampered with PIN pads, 63 stores struck

Barnes & Noble Inc said on Wednesday that customers who shopped at 63 of its stores as recently as last month may have had their credit or debit card information stolen in what the U.S. bookstore chain called a “sophisticated criminal effort.”

The retailer, which operates a total of almost 700 bookstores, said that federal law enforcement authorities have been informed of the breach and that it is supporting their investigation.

Barnes & Noble said it had detected tampering with one personal identification number (PIN) pad device at each of the 63 affected stores and by September 14 had disconnected all the pads at every one of its stores. The tampering affected fewer than 1 percent of its PIN pads.

Bugs were planted in the PIN pads that allowed credit card and PIN numbers to be pulled, Barnes & Noble said.

The company said it did not know how many customers were affected. The stores are in California, Connecticut, Florida, Illinois, Massachusetts, New Jersey, New York, Pennsylvania and Rhode Island, Barnes & Noble said.

A list of stores can be found at http://www.barnesandnobleinc.com/press_releases/10_23_12_Important_Customer_Notice.html

Barnes & Noble advised customers who have swiped their cards at any of the affected stores to change their debit-card PIN numbers as a precaution, and to check their statements for unauthorized transactions.

Still, the company said its customer database was secure, and that purchases made on the Barnes & Noble website, Nook e-reader and Nook mobile apps were not affected. It also said none of the pads at its college campus stores were affected.

Separately, a spokesman for the FBI told Reuters on Tuesday night that the agency’s New York field division was investigating the breach at Barnes & Noble.

The spokesman confirmed a report that said the company received two letters from the U.S. attorney’s office for the Southern District of New York that said it did not have to report the attacks to its customers during the investigation.

At least one of the letters said the company could wait until December 24 to inform customers.

Barnes & Noble shares were down 2.7 percent at $14.90 Wednesday morning on the New York Stock Exchange.