But such attacks often start with phishing attempts, a compromised website or a malicious insider, said cybersecurity researcher Craig Young at Tripwire, a security software company that works with such businesses as Visa, Mastercard, Walmart and Starbucks.