While retailers battle breaches that have resulted in tens of millions of credit card numbers stolen, word comes from the RSA Conference in San Francisco that a major vendor of payment terminals has been shipping devices for over two decades with the same default password. The vendor wasn’t named by the researchers, David Byrne and Charles Henderson, but they did disclose the password: 166816. A Google search reveals that’s the default password for several models of credit card terminal sold by Verifone, a Silicon Valley-based vendor that says it connects 27 million payment devices and has operations in 150 countries. The researchers said that the password remains in use on nine out of 10 terminals they see from the vendor, in part because customers mistakenly assume it is unique to them. In a statement on Thursday, Verifone acknowledged that all its devices in the field came with the same default password, which the company said was Z66831. Over the years, the password has become known and can be found on the Internet along with instructions for programming terminals, Verifone said. “The important fact to point out is that even knowing this password, sensitive payment information or PII (personally identifiable information) cannot be captured,” Verifone said. “What the password allows someone to do is to configure some settings on the terminal; all executables have to be file signed, and it is not possible to enter malware just by knowing passwords.” The company said it strongly encourages customers to change the password and that new products come with a “pre-expired” password, which requires users to change it during installation and setup. The RSA Conference is a major annual event for the security industry and the comments of the two researchers were reported by The Register and SC Magazine. Such conferences are often used to highlight poor security practices or disclose how hackers are targeting systems. The hope is that by making such information more widely known, companies and users will be more alert to cybersecurity and change bad habits. Cybercriminals have been increasingly targeting vulnerabilities in point-of-sale terminals. The largest and best known of these was the hack of Target, which affected up to 70 million customers. A breach at Home Depot compromised the payment cards of up to 56 million customers, while systems have also been hacked at Neiman Marcus, White Lodging, Michaels and The UPS Store. In part because of these breaches, the payments industry in the U.S. is moving to chip-based cards, but researchers note the security on the cards isn’t bullet-proof and in part depends on the payment terminals and other systems at retailers. Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe