Dive Brief:

• European clothing retailer Primark reported that skimming devices for stealing payment card data were illegally placed on "a limited number of card payment machines" in two of its U.S. stores in the King of Prussia Mall and Willow Grove Mall, both in Pennsylvania.

• Primark said the incidents may have affected a certain number of credit and debit card transactions beginning July 29, but that not all credit and debit card transactions were impacted.

• Primark added that it didn't know who planted the devices, but that they were removed from affected machines upon discovery. Store management immediately contacted law enforcement, and Primark is now working closely with local and federal law enforcement officials to share all available information.

Dive Insight:

This security failure is not the greatest news to emerge for a foreign retailer that began opening stores in the U.S. only about a year ago, and reportedly is still gearing up for a broader nationwide expansion.

And while Primark said a lot of the right things in its press release announcing the discovery of the skimmers — you know, about how the security of Primark's customers is a priority, and that it sincerely regrets the incidents — its announcement was also typical of retailer confirmations of security breaches in that it contained few other details.

Primark didn't provide any information on how many skimming devices were found or on how many payment terminals were impacted. It also gave a date on which transactions might have started to be affected, but it's not clear how Primark arrived at that date, or how many transactions might have occurred on affected machines before the skimming devices were discovered — or even when they were discovered. 

Basic card skimming equipment is not supposed to be able to skim data of EMV chip cards, but we also don't know yet what type of skimming devices were used. Then again, EMV doesn't solve all of our security issues. Criminals will still find a way to instigate breaches, whether online or in stores using an old-school method like card skimming devices.

Some of this information Primark left out might be kept under wraps for the purposes of the investigation, but it's still another case in which customers are left not knowing if or when their payment card data was affected.