Recent Breaches
Breaches
2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026NHS ScotlandUndisclosed records stolen2026HertzUndisclosed records stolen2025Marks & Spencer9.4M records stolen2025PayPal35K records stolen2025Jaguar Land RoverUndisclosed records stolen2025Co-operative GroupUndisclosed records stolen2024National Public Data2.9B records stolen2024Ticketmaster560M records stolen2024Change Healthcare100M+ records stolen2024AT&T73M records stolen2024Dell Technologies49M records stolen2023Progress Software (MOVEit)77M+ records stolen202323andMe6.9M records stolen2023Royal MailOperations halted records stolen2023British LibraryUndisclosed records stolen2023MGM ResortsUndisclosed records stolen2022Uber57M records stolen2022LastPass33M records stolen2022Optus9.8M records stolen2022Medibank9.7M records stolen2022Twitter5.4M records stolen2026PowerSchool62.4M records stolen2026DISA Global Solutions3.3M records stolen2026Globe Life850K records stolen
View All →
Retail

POS Network Segmentation and Payment Path Control

Retail networks span thousands of locations, each processing payment card data through point-of-sale systems connected to corporate infrastructure. A single compromised store can provide a path to every other location in the estate.

Back to Control
Control

Retail

When a guest Wi-Fi access point and a payment terminal share the same network, every customer browsing the internet is a potential path to payment card data.

100%

Payment network isolation from store IT

Zero

Persistent vendor paths to POS systems

4

Store network zones with independent governance

Full

PCI DSS 4.0 network segmentation evidence

The Challenge

Retail networks are distributed and high-value targets.

POS Compromise

Point-of-sale systems across thousands of locations create a massive attack surface for payment card data theft.

Flat Store Networks

Many retail locations share a single network for POS, back-office, CCTV, and guest Wi-Fi, enabling lateral movement from any entry point.

Supply Chain Risks

POS software vendors, payment processors, and maintenance contractors each create persistent pathways into the payment environment.

The Scenario

Scenario: Estate-Wide POS Compromise

Attackers compromise a POS software update server and distribute a modified update containing memory-scraping malware. The update propagates to 1,200 stores over a routine maintenance cycle. The malware captures payment card data from POS memory and exfiltrates it through the store internet connection, which shares the same network as the POS systems. Over eight weeks, 4.3 million payment card numbers are stolen. With Firevault Control, POS networks are physically separated from store internet connectivity. The malicious update cannot exfiltrate data because the POS network has no path to the internet. Software updates are delivered through controlled, authorised transfer windows with integrity verification.

"Our PCI assessor told us our segmentation was compliant. But it was VLAN-based. When the attackers compromised the switch management interface, every VLAN boundary in the estate became meaningless."

Solution Blueprint

Physical payment path control across the retail estate.

Retailers gain physical control over payment paths at every location. POS networks are physically isolated from store internet and back-office systems. Software updates are delivered through controlled, verified channels. Estate-wide recovery from sophisticated attacks is guaranteed through air-gapped configuration archives.

  • Physical POS network isolation at every store location
  • Controlled, verified software update delivery
  • Multi-party authorisation for payment system changes
  • Cellular management independent of store WAN
  • Continuous PCI DSS 4.0 compliance evidence
  • Air-gapped recovery for rapid store restoration
Fracture

Fracture — Emergency Store Isolation

Module 1 of 4

Physically disconnects compromised store networks from corporate infrastructure and payment systems. When a breach is detected, Fracture severs the path within seconds to prevent estate-wide propagation.

Featured In

TechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in EssexTechRadar ProConnected BritainTotal TelecomSecurity BuyerComms BusinessComms DealerBlocks & FilesYahoo FinanceGlobeNewswireChannel InsiderUK DirectorSecurityBriefPCRBusiness Time in Essex

Key Capabilities

Sovereign Payment Data

All payment system configurations and cardholder data paths remain within the agreed jurisdiction in secured Firevault Bunkers.

Multi-Party Update Control

POS software updates and configuration changes require sign-off from both IT operations and security teams before deployment.

PCI DSS 4.0 Evidence

Automated compliance logging generates continuous evidence for PCI DSS 4.0 network segmentation requirements across the entire estate.

Cellular Failover

Out-of-band management via cellular connectivity ensures control over store networks independent of primary WAN connections.

Estate-Wide Audit Trail

Every access, update, and authorisation across all locations is recorded in centralised, tamper-proof logs.

Rapid Store Recovery

Air-gapped POS configurations enable rapid restoration of compromised stores without relying on network-connected backup systems.

Demo to Live

Adoption Guide

Step 1

Estate Network Assessment

Audit network architecture across representative store locations to identify payment path exposure and segmentation gaps.

Step 2

Store Zone Architecture

Design standardised store network zones for POS, back-office, CCTV, and guest access with Control modules at each boundary.

Step 3

Pilot Store Deployment

Deploy in a representative group of stores with full payment path isolation, controlled updates, and compliance logging.

Step 4

Estate-Wide Rollout

Phased deployment across all locations with centralised management, air-gapped recovery, and continuous PCI DSS evidence generation.

Step 1

Estate Network Assessment

Audit network architecture across representative store locations to identify payment path exposure and segmentation gaps.

Step 2

Store Zone Architecture

Design standardised store network zones for POS, back-office, CCTV, and guest access with Control modules at each boundary.

Step 3

Pilot Store Deployment

Deploy in a representative group of stores with full payment path isolation, controlled updates, and compliance logging.

Step 4

Estate-Wide Rollout

Phased deployment across all locations with centralised management, air-gapped recovery, and continuous PCI DSS evidence generation.

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy