Debit card breach is traced to Cheers Liquor Mart

A debit card breach affecting thousands of Colorado Springs area cardholders resulted from outside hackers gaining access to Cheers Liquor Mart’s computer system sometime last month, owners of the Springs-based retailer said Friday.

Cheers hired Cyopsis LLC, a Denver-based information technology forensics and investigations firm, to determine the source of the breach and prevent further breeches, said Jeff Robinson, one of four owners of one of the city’s largest liquor retailers. Cyopsis is working with Colorado Springs Police to determine who was responsible for the alleged theft of the store’s customer information, which appears to have been done by “an organized group,” he said.

Cyopsis “has found where the breach occurred and shut it down. We don’t believe we are any more at risk now than any other merchant. I would use my own card there now,” Robinson said. “Obviously, the confidentiality of customer information is utmost in our dealings. We care very much about what customers entrust to us. We have been in business in the Springs for more than 20 years and will do everything possible to correct the situation.”

Robinson said he “isn’t exactly sure” how the hack occurred, but added that investigators from Cyopsis have turned over their findings directly to police. Officials from Cyopsis asked him to not release any further information because of the police investigation.

Police spokesman Lt. David Whitlock said Friday no new information on the investigation is available. He said Thursday that “thousands” of customers from five financial institutions operating in the Springs area had their numbers stolen from an unidentified local merchant. He declined to identify either the merchant or the financial institutions.

Ent Federal Credit Union, Security Service Federal Credit Union and Air Academy Federal Credit Union all began notifying affected cardholders of the breech last weekend after detecting suspicious transactions on their cards. Under federal law, customers are not liable for fraudulent transactions on debit cards if they are reported within 60 days of the first statement on which the charges appear. Customers should contact their financial institution if they become aware of suspicious transactions on their accounts.

—

Contact the writer at 636-0234