Millions of point of sales systems are vulnerable to security breaches as they are protected by the same default password - used by a global maker of payment devices for more than two decades, researches say. The password, 166816, is still being used by about 90 per cent of customers, researchers David Byrne and Charles Henderson disclosed on Wednesday during the annual RSA security conference in California. Henderson said that the unidentified vendor had been using the same default password since at least 1990, according to The Register. Researchers Charles Henderson (right) and David Byrne (left) said a global maker of cash registers has been using the same default password on the payment devices for more than two decades. This potentailly puts the devices at risk of being a target of a security breach . 'Nine out of 10 times when we see equipment from that manufacturer, 90 per cent of the time, this is the password,' he said. 'I actually saw this password really recently on a different manufacturer's device [by a customer] who thought the password was unique to them.' Hackers would need physical access to the payment devices, opening a panel of the device using a paperclip, to exploit it, according to The Register. This type of attack is uncommon and reportedly easy for malicious staff. For example, during the conference it was revealed that two individuals reportedly entered a major American retail store, unscrewed a server rack and walked out with the server leaving the store unable to process credit card payments, according to RT. While Henderson and Byrne did not name the vendor using the 166816 password,  a Google search pointed to Verifone which connects around 27 million payment devices around the world, according to RT. On Thursday, Verifone said in a statement that all of its devices in the field came with the same default password, Z66831, according to CSO. The company also said the password can be found on the Internet with instructions for programming terminals. However, Verifone claimed sensitive payment information or personally identifiable information cannot be captured, even though the password has become known over the years. While Henderson and Byrne did not name the vendor, a Google search pointed to Verifone (file photo of one of the company's payment devices) The company said: 'What the password allows someone to do is to configure some settings on the terminal; all executables have to be file signed, and it is not possible to enter malware just by knowing passwords.' Its new products come with a 'pre-expired' password that has to be changed during installation set up, according to Verifone, and the company also said it encourages customers to change the default password, reported CSO. As retailers have increasingly battled security breaches in recent years, Target was at the center of the second-largest card breach at a U.S. retailer two years ago. An investigation found that hackers stole the personal information of at least 70million of Target's customers, including names, mailing addresses, telephone numbers and email addresses. Hackers are thought to have stolen the credit card details by breaking into Target's computer systems and installing data mining software on credit card machines. The software installed on 40,000 machines across Target's 1,797 stores read the information on a card's magnetic strip - including account number, sort code and CCV code - when it was swiped through the machine. All of the card details were then sent back to the hackers through the internet, before the theft was discovered after nearly three weeks. In another case of a security breach, in 2014, 56million debit and credit cards are estimated to have been breached in a data theft between April and September at Home Depot stores in the U.S. and Canada.
Researchers  said during security conference that payment devices by unidentified global vendor came with password '166816'
While researchers did not identify the vendor, Google search points to Verifone, which said its devices in the field come with password 'Z66831'
Verifone claimed sensitive payment information or personally identifiable information cannot be captured.