Goodwill Investigates Possible Breach

Goodwill Industries International, a not-for-profit organization with 165 independent agencies located throughout the U.S. and Canada, is investigating a possible payments breach, which may have impacted a yet-to-be-determined number of stores in the U.S. The breach has not yet been confirmed, the charity says.

See Also: OnDemand | 2023 OT Cybersecurity Year in Review: Lessons Learned from the Frontlines

Goodwill was contacted July 18 by federal authorities and a "payment card industry fraud investigative unit" of a possible compromise, according to a statement the charity provided to Information Security Media Group.

"Investigators are currently reviewing available information," says Lauren Lawson-Zilai, a Goodwill spokesperson. "At this point, no breach has been confirmed but an investigation is under way."

Goodwill sells donated clothes and provides job training, employment placement services and other community-based programs. The organization has a presence in 16 countries, but operations function autonomously; it does not have a central point-of-sale network, Lawson-Zilai says.

At this point, no cards have yet been linked to fraud, Goodwill and a handful of card-issuing institutions tell ISMG. "We are proactively engaged with the payment card industry contacts, the Secret Service and all Goodwill headquarters to identify what problem, if any, exists so that we can take prompt and appropriate actions as well as communicate appropriately to any affected parties," Lawson-Zilai says.

Card issuers told ISMG on July 17 that a possible breach at Goodwill was on their radar, but nothing had yet been confirmed regarding a possible breach timeline or compromise scope.

POS Breaches Growing

If the card breach is confirmed, it would be the latest in a string of point-of-sale incidents that have impacted credit and debit cards at U.S. merchants, including P.F. Chang's, Target Corp., Neiman Marcus and Michaels.

"Goodwills across the country take the data of consumers seriously and their community well-being is our number one concern," Lawson-Zilai says. "Goodwill Industries International is working with industry contacts and the federal authorities on the investigation. We will remain appraised of the situation and will work proactively with any individual local Goodwill involved, taking appropriate actions if a data compromise is uncovered."

(Executive Editor Tracy Kitten contributed to this story.)