PAX Technology Warehouse in Jacksonville Florida was the subject of a search and investigation October 26, 2021 by the Federal Bureau of Investigation, the Department of Homeland Security, and several other agencies. PAX is a Chinese credit card terminal provider that significantly grew it’s global reach, including the US, during the transition to EMV chip terminals.

Brian Krebs, a cybersecurity investigative journalist, reported a major US payment processor noticed that PAX terminals were being used both as a malware “dropper” — a repository for malicious files — and as “command-and-control” locations for staging attacks and collecting information. Something didn’t add up and PAX didn’t give any good answers.

FBI Statement: “The FBI Jacksonville Division, in partnership with Homeland Security Investigations, Customs and Border Protection, Department of Commerce, and Naval Criminal Investigative Services, and with the support of the Jacksonville Sheriff’s Office, is executing a court-authorized search at this location in furtherance of a federal investigation. We are not aware of any physical threat to the surrounding community related to this search. The investigation remains active and ongoing and no additional information can be confirmed at this time.”

US vendors in the payments ecosystem were quick to respond. The sale and installation of PAX terminals has already been prohibited by some.