Extent of TJX Credit Breach Grows Larger
9338
At least 94 million Visa and MasterCard accounts may have been exposed to potential fraud in a data breach at TJX, more than double the previous estimate by the discount retailer.
479464
(InfoWorld) - When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems. Just as the now famous attack on discount clothing chain TJX Stores revolved around the interception of data transmitted wirelessly from the company's registers to its databases, almost every call that Sartin receives from a retailer can be traced back to some issue related to point-of-sale information collection, he said. The data theft gumshoe -- whose official title is managing principal in the Investigative Response unit at managed security services provider Cybertrust, which was purchased by Verizon Business in May 2007 -- contends that if companies did a better job of defending their point-of-sale tools, most could dramatically lower their risk of a breach. "As a rule, companies are doing a better job of protecting against external IT systems intrusions, but if you look into most of these consumer breaches at retailers the point-of-sale technology is typically the common denominator," Sartin said. "Many retailers list the types of systems they use on their Web sites, so the smart criminals look for companies using systems they already know how to beat and simply try to find a way in." If retailers could merely stop collecting as much data at their registers, it would seem, the companies would significantly improve their ability to protect against such attacks, but the issue isn't that simple. In order to protect themselves against fraud on the part of customers -- primarily in the form of inappropriate returns -- the companies are forced to store some form of identification data, typically a credit card number -- to prevent the need to write off even more losses to crime. Among the databases of information scooped from TJX were some that carried such returns information. As a result, retail companies find themselves in a tricky situation where they are being forced to consider alternatives that allow them to reduce the level of customer data collected at the point-of-sale, while retaining enough information to protect against fraud. Flashback to the early 1990s, and video game console maker Nintendo was dealing with a challenging business problem. The Kyoto, Japan-based electronics company was selling millions of its NES video game consoles, but it was also being routinely fleeced by customers via fraudulent returns. Typically such transactions would involve people who would buy new gaming systems, place older, broken consoles in the new box, and then simply return the devices for a full refund. The company was losing large amounts of money and dealing with retailers who were shipping back scads of the worn-out machines, and attempts to implement manual guidelines, such as collecting more detailed data about customers, failed to deliver results. Faced with mounting costs, the company decided to employ a technological strategy for warding off fraudulent activity. By capturing the information on each box carrying each one of its consoles and creating an electronic receipt based on its UPC code and serial number at the point-of-sale, the firm discovered, it could build a database of pertinent information that would allow it to track sales without retaining customer data. By recording the information on the box, along with details about the retailer who sold it -- such as their geographic location and store number -- along with the date and time of an item's sale, Nintendo found that it could prevent many attempted returns that involved fraudulent behavior. The system was piloted at Wal-Mart in 1995, and rapidly expanded into other retailers worldwide. The company soon realized it had a hit on its hands when its largest rival at the time, Sega, came calling after hearing how well the system worked from its own retail partners. As a result, Nintendo decided to spin off the technology into its own company, Siras, in 1999. With massive manufacturers including General Electric, Hewlett-Packard, Philips and Sony, and retailers such as Best Buy, CompUSA, Sears and Target using the Siras Electronic Registration system today, the company maintains it provides an easy solution to the point-of-sale data collection nightmare presently facing retailers. By eliminating the need to collect customer data, including credit card numbers, said company officials, Siras feels it can also allow retailers and manufacturers to protect themselves from information exposure incidents and all the related fallout such events may bring. "Once consumer data is collected it's really just a matter of time before it gets exposed or stolen, and you don't need to be a sophisticated hacker to commit such a crime, a lot of times it's a retail employee who finds a way to capture the data and sell it," said Peter Junger, president of Siras, based in Redmond, Wash. "Meanwhile, many point-of-sale systems can be easily hacked, and radio frequency ID tools that aim to help solve these problems are still many years away." By purposefully avoiding the collection of personal data using a system such as Siras', companies can already begin lowering their risk while streamlining the retail shopping and returns process for themselves and their customers, he said. After collecting the UPC and sales information, the data is transmitted to a national database presided over by Siras, allowing the software maker to handle much of the legwork and eliminate related point-of-sale management costs for retailers, according to Junger. Siras is also in the process of developing other iterations of Electronic Registration for use by law enforcement officials tracking the movement of stolen goods, and for pawn shops and online auction sites that are trying to reduce sales of misappropriated or counterfeit goods. "It's a very simple technological approach to a complex problem," Junger said. "And we're hoping that someday its use will stretch far beyond electronics and other high-end items into almost any type of products that carries a serial number." One company already using Siras' tools is the consumer products division of Philips Electronics North America, the New York based manufacturer of everything from desktop computers to flat-screen TVs. Prior to implementing Siras in 2001, Philips dealt with the same sorts of issues that drove Nintendo to create the technology, but since that time, consumer fraud has been cut significantly, said Tony Sciarrotta, director of returns management for Phillips Consumer Electronics. "It's had a huge bottom-line impact, helping us save not just on the cost of fraudulently returned products, but also the need to reimburse retailers who get victimized," Sciarrotta said. "The consumer information is not attached to registration, which is a huge win for consumers who have concerns about privacy, and for retailers afraid of a breach incident, and the technology can be applied to almost anything you want to sell." Sciarrotta said that he would like to see larger numbers of retailers adopt Siras, and that he believes such tools should be required across the industry to lower the risk of consumer data loss. "There are certainly times when we would like to have a lot more consumer information, but that's not in the best interest of everyone involved, so we need to get it in other ways such as encouraging product registration after the sale," he said. "From our side we don't want to be the police or the gatekeeper, we want to allow our retailers to go about their business as easily as possible with the least amount of risk for loss; over all my years in this industry, this is one of the best ideas I've ever seen along those lines."
655165
TJX, best known for T.J. Maxx and Marshalls stores, says its  investigation uncovers more extensive exposure of credit and debit cards than previously believed.
602831
Credit card processing firm Authorize.Net said today that it was the target of a large-scale distributed denial-of-service attack that had caused disruptions for customers.
428558
The TJX Companies, Inc., a discount retailer, said Friday it settled class action lawsuits in the United States, Canada and Puerto Rico stemming from a massive security breach of customer data that affected at least 45 million credit and debit cards.
679026
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. &quot;We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out,&quot; he said.The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.The missing backup tape was unencrypted.Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. &quot;Clearly that number includes many of the national retail organizations,&quot; he said.The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit-card accounts, a common form of identity theft.Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit monitoring services to those affected by the breach.In 2006, retailer TJ Maxx discovered that thieves had&#160;broken into its computer networks, stealing an estimated 94 million credit- and debit-card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.GE Money is a division of General Electric.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
207163
Thousands of credit card numbers and other personal data may have been compromised.
11046
(InfoWorld) - Organizations that experience data breaches must move quickly to assuage the fears of their constituents and go beyond expectations to address the situations effectively, according to those most familiar with the incidents. Speaking at the ongoing Security Standard Conference in Chicago, a pair of experts offered advice for handling situations where sensitive user or customer data is lost or stolen, and examined the missteps taken by retailer TJX Companies in handling its now-notorious credit card information theft. First to the podium was David Escalante, director of computer policy and security at Boston College, which in March 2005 experienced a break in to a server containing sensitive alumni fund-raising information. By addressing the situation head-on and moving to inform anyone whose data may have been exposed in the incident -- which was ultimately blamed on a third-party IT services provider that managed the affected system -- Escalante said BC was able to minimize the impact of the event and quickly move on. "This was probably the low point of my career," said Escalante. "But while it was a bad thing to have happen, it seemed at the time that we were doing the right things to handle it, and I'm glad to say that turned out to be the case." Less than two weeks after BC discovered the breach, the school had assembled a comprehensive incident response plan and had mailed out 100,000 warning letters to anyone whose data may have been stored in the system. By aggressively seeking to communicate with its constituents, including setting up phone lines on which its alumni could call and complain about the issue, the school was able to move past the situation and better prepare for any future breach events, he said. Among the tips that Escalante offered for managing such a crisis was to huddle different organizational officials "like a football team" and loop in everyone from the school's public relations department to its campus police force and IT management groups. By creating a cross-organizational strategy to handle different aspects of the breach, the administrator said, the school was able to assemble the right mix of people to work on different tasks -- from applying computer forensics to study aspects of the breach itself to aligning the right mix of leadership to oversee the entire response process. At the same time, it was crucial to establish separation of duties early in the game, Escalante said. "It's good to keep your upper management separate from your response team because they can get in the way. You want management involved, but you don't want them focusing on every little issue," said Escalante. "At the same time by bringing together a diverse response team, IT and security didn't have to coordinate every issue for themselves." In addition to seeking legal help from its attorneys, the school was able to communicate effectively with law enforcement officials investigating the incident since BC had already familiarized itself with those people before the breach. On the flip side, when Tufts University experienced a similar issue, administrators at the school called Escalante to seek his advice as they didn't know what to expect from law enforcement agencies, he said. Overall, Escalante said organizations should go slightly overboard to impress on their constituents how serious they feel the problem is and how they can help to fix any related problems. "Put the people whose data is lost up front. If you don't tell them and apologize, it will hurt more in the end," Escalante said. Addressing the problematic breach response of TJX Companies, a Framingham, Mass.-based retailer that reported in March 2007 that over 45.6 million customer credit and debit card numbers were stolen from one of its systems over a period of several years, was Richard Stiennon, a well-known security pundit who currently serves as chief marketing officer at filtering appliance maker Fortinet. Stiennon said that many people now believe the TJX attacks came from kiosks in the company's stores that were used by job seekers to fill out applications. People who were hacking the company simply applied for jobs at TJX stores and planted programs that could be used to intercept credit card data being transmitted in unencrypted form from point of sale systems in the locations. Handling sensitive data in such a careless way was the first mistake TJX made, and it had plenty of warning that such attacks could be carried out on point-of-sale systems, the expert contends. Among the additional mistakes made by TJX was not reporting the incident for months, or even years, after it first discovered the hack, he said, as well as failing to address the situation in public and apologize sufficiently to its customers. TJX has also refused to share information about the attack publicly to help other companies avoid such incidents, Stiennon said. "There's been a significant lack of core with TJX's response. They didn't overreact as they probably should have, unlike BC," Stiennon said. "As a result they've become the poster child for data breaches and how not to communicate risk to the rest of the security industry."
641431
The loss or theft of personal data such as credit card and Social Security numbers soared to unprecedented levels in 2007
156433
Pressure mounted on TJX Cos. yesterday after an Alabama bank filed a class action lawsuit against the Framingham discounter for negligence and breach of contract as Massachusetts Congressman Ed Markey called on the Federal Trade Commission to investigate how the company lost control of potentially millions of customers' credit- and debit-card data.
201768
Record-breaking data leak was 'foreseeable' The leak of 45 million people's credit card information was caused by retailer TJX gathering too much data and not protecting it properly, according to the Canadian privacy commissioner.â¦
139167
Merger and acquisition activity involving UK banks set a new record before the crisis in the credit market.
654076
Time to call the credit bureaus? Almost 1.4 million records containing the personal information of Californians likely stolen.
48524
Visa USA issued $880,000 in penalties against a bank that processed transactions for TJX Cos. , after an investigation of a computer hacking incident at the retailer.
486694
At her first shareholder meeting as chief executive of TJX Cos. , Carol Meyerowitz yesterday apologized for the Framingham merchant's recent security breach that involved the theft of at least 45.7 million credit and debit card numbers and said she wished the incident -- the biggest loss of personal data reported -- never happened.
137525
BOSTON - BJ&#39;s Wholesale Club Inc. said Tuesday that sales growth boosted second-quarter earnings 25 percent, and the bulk retailer disclosed it faces $16 million in claims over the theft of some of its customers&#39; credit and debit card ...