TJX Offers Settlement in Wake of Massive Data Breach
104755
Consumers whose personal data may have been compromised will be offered three years of credit-monitoring services and other perks by TJX.
11046
(InfoWorld) - Organizations that experience data breaches must move quickly to assuage the fears of their constituents and go beyond expectations to address the situations effectively, according to those most familiar with the incidents. Speaking at the ongoing Security Standard Conference in Chicago, a pair of experts offered advice for handling situations where sensitive user or customer data is lost or stolen, and examined the missteps taken by retailer TJX Companies in handling its now-notorious credit card information theft. First to the podium was David Escalante, director of computer policy and security at Boston College, which in March 2005 experienced a break in to a server containing sensitive alumni fund-raising information. By addressing the situation head-on and moving to inform anyone whose data may have been exposed in the incident -- which was ultimately blamed on a third-party IT services provider that managed the affected system -- Escalante said BC was able to minimize the impact of the event and quickly move on. "This was probably the low point of my career," said Escalante. "But while it was a bad thing to have happen, it seemed at the time that we were doing the right things to handle it, and I'm glad to say that turned out to be the case." Less than two weeks after BC discovered the breach, the school had assembled a comprehensive incident response plan and had mailed out 100,000 warning letters to anyone whose data may have been stored in the system. By aggressively seeking to communicate with its constituents, including setting up phone lines on which its alumni could call and complain about the issue, the school was able to move past the situation and better prepare for any future breach events, he said. Among the tips that Escalante offered for managing such a crisis was to huddle different organizational officials "like a football team" and loop in everyone from the school's public relations department to its campus police force and IT management groups. By creating a cross-organizational strategy to handle different aspects of the breach, the administrator said, the school was able to assemble the right mix of people to work on different tasks -- from applying computer forensics to study aspects of the breach itself to aligning the right mix of leadership to oversee the entire response process. At the same time, it was crucial to establish separation of duties early in the game, Escalante said. "It's good to keep your upper management separate from your response team because they can get in the way. You want management involved, but you don't want them focusing on every little issue," said Escalante. "At the same time by bringing together a diverse response team, IT and security didn't have to coordinate every issue for themselves." In addition to seeking legal help from its attorneys, the school was able to communicate effectively with law enforcement officials investigating the incident since BC had already familiarized itself with those people before the breach. On the flip side, when Tufts University experienced a similar issue, administrators at the school called Escalante to seek his advice as they didn't know what to expect from law enforcement agencies, he said. Overall, Escalante said organizations should go slightly overboard to impress on their constituents how serious they feel the problem is and how they can help to fix any related problems. "Put the people whose data is lost up front. If you don't tell them and apologize, it will hurt more in the end," Escalante said. Addressing the problematic breach response of TJX Companies, a Framingham, Mass.-based retailer that reported in March 2007 that over 45.6 million customer credit and debit card numbers were stolen from one of its systems over a period of several years, was Richard Stiennon, a well-known security pundit who currently serves as chief marketing officer at filtering appliance maker Fortinet. Stiennon said that many people now believe the TJX attacks came from kiosks in the company's stores that were used by job seekers to fill out applications. People who were hacking the company simply applied for jobs at TJX stores and planted programs that could be used to intercept credit card data being transmitted in unencrypted form from point of sale systems in the locations. Handling sensitive data in such a careless way was the first mistake TJX made, and it had plenty of warning that such attacks could be carried out on point-of-sale systems, the expert contends. Among the additional mistakes made by TJX was not reporting the incident for months, or even years, after it first discovered the hack, he said, as well as failing to address the situation in public and apologize sufficiently to its customers. TJX has also refused to share information about the attack publicly to help other companies avoid such incidents, Stiennon said. "There's been a significant lack of core with TJX's response. They didn't overreact as they probably should have, unlike BC," Stiennon said. "As a result they've become the poster child for data breaches and how not to communicate risk to the rest of the security industry."
486035
The U.S. Federal Trade Commission (FTC)&#160;has settled a complaint with a Web-based company it accused of selling people&#39;s telephone records without permission, the agency said Monday.The settlement with CEO Group, doing business as Check Em Out, bars the company and its operator Scott Joseph from marketing or selling phone records, and it requires the company to give up $25,000 of its profits from selling phone records. Selling phone records to third parties is illegal under federal law, the FTC had charged.The FTC in May 2006 filed complaints in U.S. court against five Web-based companies that obtained and sold confidential phone records to third parties. In addition to the settlement with CEO Group, the FTC has settled two other cases and obtained a default judgment against a fourth company. The complaint against the fifth company is still active.The FTC&#39;s complaints came after complaints from privacy groups and members of the U.S. Congress about pretexting, when someone obtains a telephone customers&#39; records without permission under false pretexts. In many cases, companies offering phone records over the Internet were calling telephone carriers and pretending to be the targeted customer. In September 2006,&#160;Hewlett-Packard revealed it had been spying on some of its board members and journalists in an attempt to uncover the source of boardroom leaks, and HP officials later said their investigators had used pretexting to obtain phone records.The Telecommunications Act of 1996 prohibits customers&#39; phone records from being disclosed unless &quot;upon affirmative written request by the customer.&quot; The FTC charged the five Web-based companies of engaging in unfair business practices.The settlement with CEO Group prohibits it from obtaining, marketing or selling consumer phone records or other consumer personal information except where allowed by law, the FTC said in a news release. The settlement, approved by the U.S. District Court for the Southern District of Florida, includes a judgment of $222,381, the amount the company earned by selling phone records, but the defendants said they were able to pay only $25,000. If the court finds that the defendants misrepresented their finances, the entire amount will be due, the FTC said.
101804
Computer Associates has announced a deal with the US Department of Justice and the Securities and Exchange Commission that will solve the software vendor&#39;s accounting scandal.
710363
By Thomas J. Morgan; Journal Staff Writer  The company agrees to pay more than $100,000 in penalties and contributions.
714418
(InfoWorld) - An Internet business that sold people's telephone and credit-card records has agreed to settle charges that it violated U.S. law, the U.S. Federal Trade Commission (FTC) said Thursday. Integrity Security & Investigation Services and its owner, Edmund Edmister, will give up $2,700, the entire amount the company earned from selling phone records and credit card transaction reports, the FTC said. The settlement also bars the company from obtaining and selling confidential phone and credit account records unless authorized by law or court order. The FTC in MayÂ filed federal court complaintsÂ against five Web-based operations allegedly engaged in pretexting, attempting to obtain phone or other personal records from companies by pretending to be the targeted customer. Integrity Security & Investigation Services is the first firm to settle with the FTC; charges are still pending against the four remaining companies. The U.S. Congress has beenÂ investigating pretextingÂ since early this year, but the practice gained national attention last month whenÂ Hewlett-Packard officials revealedÂ pretexting had been used to gain access to the phone records of employees, board members and journalists. Private investigators employed by HP allegedly used pretexting in an investigation of board leaks in 2005 and 2006. The agency dismissed charges against F. Lynne Moseley and Tracey Edmister, Integrity Security & Investigation Services corporate officers. The FTC determined they played no role in operating the business.
661502
Passengers cheated in price-fixing scam will receive $200m compensation after airlines agree settlement
632168
The settlement resolves regulatory charges related to e-mails Morgan Stanley said were destroyed in the September 11, 2001, attacks, but in fact were saved on backup files.
640382
A data breach that exposed personal information on more than 6.2 million TD Ameritrade customers may have occurred in 2006, about a year before the brokerage disclosed the incident.
511400
The worst data breach made public so far -- the one that affected customers of TJX Companies -- is even worse than first thought. Court documents indicate that the number of accounts affected is 94 million, more than double initial estimates.
535315
Hackers stole millions of credit card numbers from discount retailer TJX Cos. by intercepting wireless transfers of customer information at two Miami-area Marshalls stores, according to an eight-month investigation by the Canadian government.
740230
The breach at TJX Companies occurred almost a full-year earlier than first thought -- and compromised more payment card data than previously believed, the company said.
9338
At least 94 million Visa and MasterCard accounts may have been exposed to potential fraud in a data breach at TJX, more than double the previous estimate by the discount retailer.
549845
(InfoWorld) - Rich Baich knows about data theft. Back in 2005, Baich was where he is now: at the RSA Security Conference in San Francisco, a published author and star in the tight-knit community of information security experts. Then the roof fell in as Baich's employer, data broker ChoicePoint, revealed that it had unwittingly allowed identity thieves posing as legitimate customers to make off with the financial records of more than 163,000 consumers. For months afterward, Baich, now a Principal at consulting firm Deloitte, was forced to explain how the security lapse had happened and to defend his performance as the CISO in light of the breach. His company was ultimately forced to pay $15 million in penalties and compensation as a result of the breach in a deal with the FTC. Two years later, ChoicePoint is just one in a string of major data breaches that now includes companies like Massachusetts retailer TJX, and Baich is back at RSA with a new book, a new job, and a new perspective on the problems of companies like ChoicePoint, CardSystems, or TJX, which he sees as symptoms of a broader, societal failure to recognize the value of personal data. Chatting with InfoWorld in a hotel across from San Francisco's Moscone Center, where the RSA Conference is in full swing, Baich said that the U.S. needs a grassroots campaign to educate ordinary citizens about the need to protect their personal information. Baich, who was accompanied by an attentive press officer from Deloitte, was circumspect when asked to comment on the recent breach at TJX but said that companies need to do a better job of understanding the "lifecycle" of information within their organizations and need to develop strategies to combat data loss that are based on risk, not merely on compliance demands or technology. Asked to comment on TJX's decision to wait more than a month after disclosing the theft of credit card data from its network, Baich said that companies are often under orders from law enforcement to keep news of a breach secret while an investigation is ongoing. However, companies need to do a better job about protecting their interests -- asking law enforcement to put their request to suppress information about a breach in writing, then being honest in saying that the company held off on notifying the public at the request of law enforcement, for example. Baich, who faced stern criticism from many former supporters for suggesting that the failure of ChoicePoint to vet its customers wasn't the purview of the CISO, said he now has a more holistic view of enterprise security after working on behalf of companies for Price Waterhouse Coopers and now Deloitte. "It's allowed me to experience things differently. You can't talk about security or privacy and compliance without talking about people, policies, and processes," he said. Among other things, companies need to plan in advance for incidents like the TJX or ChoicePoint breach and create cross-disciplinary teams, including human resources, legal, information security, physical security, and law enforcement personnel, to respond to them when they occur, Baich said. "More than ever, companies are evaluated on their response by the press and by their shareholders," he said. "There's an opportunity to consolidate those into an effective, functioning team that takes a mature, holistic approach, but it requires organizational change." However, even the best-intentioned companies will continue to wrestle with breaches if the public's awareness of the threat of identity theft and data loss isn't improved. As an example, Baich cites a promotion currently going on in San Francisco by radio station KFRC 99.7 where users are asked to fax the station something with the numbers 997 in it -- including possible social security or driver's license numbers -- in order to win a prize. Baich shakes his head. "As an employer, what can you really do to prevent your employees from doing something like that?" he asks. "As a society, we have to mature from an ethical standpoint in the way we protect information," he said. But companies and public sector organizations are equally in need of schooling. As a counterpoint to the KFRC story, Baich recalls a recent hotel stay in New York City where he was asked to provide a driver's license so the hotel could make a photocopy for its records and noted a recent column in the San Francisco Chronicle about thousands of Visa applications from the Indian Consulate in San Francisco, which were sent whole to a recycling center and sat, in the open, for months before Consulate officials were notified of the problems. The documents contained detailed personal information that would be useful to identity thieves and included applications submitted by Byron Pollitt, CFO of San Francisco's The Gap, and Anne Gust, wife of California Attorney General Jerry Brown. "These are more cultural issues than technology issues," he said. "We need a grassroots campaign to raise awareness about this," he said.
248222
The Business Software Alliance has collected a record settlement of nearly $3.5 million from an international media firm that was usingÂ unlicensed software, the trade group announced Tuesday.
172460
TJX has revealed that a breach of its credit card transaction systems occurred a year earlier than previously disclosed and that many more customers may have been affected.
193080
The Internet phone provider now faces paying out hefty damages and a possible shutdown of its service.