An initial investigation revealed that someone, most likely outside the United States, remotely installed malware on the Big Rapids restaurant's server sometime during the past month. 

During its 2014 study, PANscan scanned 145,144 gigs of data on 2,590 computers and found:
* A total of 87,206,203 unencrypted payment cards
* 63.86% of businesses store unencrypted PAN data
* 7.37% of businesses store full magnetic stripe data, including PIN, CVV, service code, expiration date, cardholder * name, and PAN.

While researching POS RAM scraper malware, I came across an interesting sample: a RAR archive that contained a development version of a POS RAM Scraper malware and a cracked copy of Ground Labs’ Card Recon software. Card Recon is a commercial Data Leakage Prevention (DLP) product used by merchants for PCI compliance. It looks like the criminal gangs are using the RAM scrapers to dump memory, and (ironically) using DLP to find the cards. 

The criminals need to check and validate the data they have stolen, which they then sell in the underground carder marketplace. Selling bad data will damage their reputation and might even have nastier repercussions than merely losing credibility.
The malware will use the regex to capture data from the RAM and then use the function Luhn to validate the data. This function takes a string as input and returns a Boolean value: true or false. Invalid data is discarded, and the malware exfiltrates only valid results.
While this code is functional, it’s not particularly suitable for high-volume data collection: it’s just too computationally intensive. Using an offline DLP solution like the cracked Card Recon is ideal. If you recall the massive Target data breach from last year, pragmatically validating 70 million payment cards is best done outside any compromised network.

After weeks of analysis, we discovered evidence confirming that systems of Michaels stores in the United States and our subsidiary, Aaron Brothers, were attacked by criminals using highly sophisticated malware that had not been encountered previously by either of the security firms. The affected U.S. systems contained certain payment card information, such as payment card number and expiration date, about both Michaels and Aaron Brothers customers. 

A total of 16 Hess gas stations are involved, including one in Fort Myers. We're talking about the Hess gas station located on 15260 McGregor Boulevard off Iona Road.