Millions of point of sales systems are vulnerable to security breaches as they are protected by the same default password - used by a global maker of payment devices for more than two decades , researches say . The password , 166816 , is still being used by about 90 per cent of customers , researchers David Byrne and Charles Henderson disclosed on Wednesday during the annual RSA security conference in California . Henderson said that the unidentified vendor had been using the same default password since at least 1990 , according to The Register . Researchers Charles Henderson ( right ) and David Byrne ( left ) said a global maker of cash registers has been using the same default password on the payment devices for more than two decades . This potentailly puts the devices at risk of being a target of a security breach . 'Nine out of 10 times when we see equipment from that manufacturer , 90 per cent of the time , this is the password , ' he said . ' I actually saw this password really recently on a different manufacturer 's device [ by a customer ] who thought the password was unique to them . ' Hackers would need physical access to the payment devices , opening a panel of the device using a paperclip , to exploit it , according to The Register . This type of attack is uncommon and reportedly easy for malicious staff . For example , during the conference it was revealed that two individuals reportedly entered a major American retail store , unscrewed a server rack and walked out with the server leaving the store unable to process credit card payments , according to RT . While Henderson and Byrne did not name the vendor using the 166816 password , a Google search pointed to Verifone which connects around 27 million payment devices around the world , according to RT . On Thursday , Verifone said in a statement that all of its devices in the field came with the same default password , Z66831 , according to CSO . The company also said the password can be found on the Internet with instructions for programming terminals . However , Verifone claimed sensitive payment information or personally identifiable information can not be captured , even though the password has become known over the years . While Henderson and Byrne did not name the vendor , a Google search pointed to Verifone ( file photo of one of the company 's payment devices ) The company said : 'What the password allows someone to do is to configure some settings on the terminal ; all executables have to be file signed , and it is not possible to enter malware just by knowing passwords . ' Its new products come with a 'pre-expired ' password that has to be changed during installation set up , according to Verifone , and the company also said it encourages customers to change the default password , reported CSO . As retailers have increasingly battled security breaches in recent years , Target was at the center of the second-largest card breach at a U.S. retailer two years ago . An investigation found that hackers stole the personal information of at least 70million of Target 's customers , including names , mailing addresses , telephone numbers and email addresses . Hackers are thought to have stolen the credit card details by breaking into Target 's computer systems and installing data mining software on credit card machines . The software installed on 40,000 machines across Target 's 1,797 stores read the information on a card 's magnetic strip - including account number , sort code and CCV code - when it was swiped through the machine . All of the card details were then sent back to the hackers through the internet , before the theft was discovered after nearly three weeks . In another case of a security breach , in 2014 , 56million debit and credit cards are estimated to have been breached in a data theft between April and September at Home Depot stores in the U.S. and Canada .
Researchers said during security testing that payment devices by unidentified global vendor came with password ' 166816 ' While researchers did not identify the vendor , sending search points to Verifone , which means its devices in the marketplace come with password ' Z66831 ' Verifone where sensitive payment information or personally identifiable information could not be accessed .