Customer Data Breach Began in 2005, TJX Says
61820
Retail giant TJX, whose stores include discount clothing chains T.J. Maxx and Marshalls, said yesterday that a computer-security breach stretched back 10 months earlier than the company originally thought, compromising credit and debit card data, drivers' license numbers, and names and addresses.
479464
(InfoWorld) - When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems. Just as the now famous attack on discount clothing chain TJX Stores revolved around the interception of data transmitted wirelessly from the company's registers to its databases, almost every call that Sartin receives from a retailer can be traced back to some issue related to point-of-sale information collection, he said. The data theft gumshoe -- whose official title is managing principal in the Investigative Response unit at managed security services provider Cybertrust, which was purchased by Verizon Business in May 2007 -- contends that if companies did a better job of defending their point-of-sale tools, most could dramatically lower their risk of a breach. "As a rule, companies are doing a better job of protecting against external IT systems intrusions, but if you look into most of these consumer breaches at retailers the point-of-sale technology is typically the common denominator," Sartin said. "Many retailers list the types of systems they use on their Web sites, so the smart criminals look for companies using systems they already know how to beat and simply try to find a way in." If retailers could merely stop collecting as much data at their registers, it would seem, the companies would significantly improve their ability to protect against such attacks, but the issue isn't that simple. In order to protect themselves against fraud on the part of customers -- primarily in the form of inappropriate returns -- the companies are forced to store some form of identification data, typically a credit card number -- to prevent the need to write off even more losses to crime. Among the databases of information scooped from TJX were some that carried such returns information. As a result, retail companies find themselves in a tricky situation where they are being forced to consider alternatives that allow them to reduce the level of customer data collected at the point-of-sale, while retaining enough information to protect against fraud. Flashback to the early 1990s, and video game console maker Nintendo was dealing with a challenging business problem. The Kyoto, Japan-based electronics company was selling millions of its NES video game consoles, but it was also being routinely fleeced by customers via fraudulent returns. Typically such transactions would involve people who would buy new gaming systems, place older, broken consoles in the new box, and then simply return the devices for a full refund. The company was losing large amounts of money and dealing with retailers who were shipping back scads of the worn-out machines, and attempts to implement manual guidelines, such as collecting more detailed data about customers, failed to deliver results. Faced with mounting costs, the company decided to employ a technological strategy for warding off fraudulent activity. By capturing the information on each box carrying each one of its consoles and creating an electronic receipt based on its UPC code and serial number at the point-of-sale, the firm discovered, it could build a database of pertinent information that would allow it to track sales without retaining customer data. By recording the information on the box, along with details about the retailer who sold it -- such as their geographic location and store number -- along with the date and time of an item's sale, Nintendo found that it could prevent many attempted returns that involved fraudulent behavior. The system was piloted at Wal-Mart in 1995, and rapidly expanded into other retailers worldwide. The company soon realized it had a hit on its hands when its largest rival at the time, Sega, came calling after hearing how well the system worked from its own retail partners. As a result, Nintendo decided to spin off the technology into its own company, Siras, in 1999. With massive manufacturers including General Electric, Hewlett-Packard, Philips and Sony, and retailers such as Best Buy, CompUSA, Sears and Target using the Siras Electronic Registration system today, the company maintains it provides an easy solution to the point-of-sale data collection nightmare presently facing retailers. By eliminating the need to collect customer data, including credit card numbers, said company officials, Siras feels it can also allow retailers and manufacturers to protect themselves from information exposure incidents and all the related fallout such events may bring. "Once consumer data is collected it's really just a matter of time before it gets exposed or stolen, and you don't need to be a sophisticated hacker to commit such a crime, a lot of times it's a retail employee who finds a way to capture the data and sell it," said Peter Junger, president of Siras, based in Redmond, Wash. "Meanwhile, many point-of-sale systems can be easily hacked, and radio frequency ID tools that aim to help solve these problems are still many years away." By purposefully avoiding the collection of personal data using a system such as Siras', companies can already begin lowering their risk while streamlining the retail shopping and returns process for themselves and their customers, he said. After collecting the UPC and sales information, the data is transmitted to a national database presided over by Siras, allowing the software maker to handle much of the legwork and eliminate related point-of-sale management costs for retailers, according to Junger. Siras is also in the process of developing other iterations of Electronic Registration for use by law enforcement officials tracking the movement of stolen goods, and for pawn shops and online auction sites that are trying to reduce sales of misappropriated or counterfeit goods. "It's a very simple technological approach to a complex problem," Junger said. "And we're hoping that someday its use will stretch far beyond electronics and other high-end items into almost any type of products that carries a serial number." One company already using Siras' tools is the consumer products division of Philips Electronics North America, the New York based manufacturer of everything from desktop computers to flat-screen TVs. Prior to implementing Siras in 2001, Philips dealt with the same sorts of issues that drove Nintendo to create the technology, but since that time, consumer fraud has been cut significantly, said Tony Sciarrotta, director of returns management for Phillips Consumer Electronics. "It's had a huge bottom-line impact, helping us save not just on the cost of fraudulently returned products, but also the need to reimburse retailers who get victimized," Sciarrotta said. "The consumer information is not attached to registration, which is a huge win for consumers who have concerns about privacy, and for retailers afraid of a breach incident, and the technology can be applied to almost anything you want to sell." Sciarrotta said that he would like to see larger numbers of retailers adopt Siras, and that he believes such tools should be required across the industry to lower the risk of consumer data loss. "There are certainly times when we would like to have a lot more consumer information, but that's not in the best interest of everyone involved, so we need to get it in other ways such as encouraging product registration after the sale," he said. "From our side we don't want to be the police or the gatekeeper, we want to allow our retailers to go about their business as easily as possible with the least amount of risk for loss; over all my years in this industry, this is one of the best ideas I've ever seen along those lines."
736722
The data aggregator said that it has reached a deal to settle a class-action suit filed by shareholders over the massive data breach the company disclosed in early 2005.
310622
The U.S. Federal Trade Commission (FTC) is looking for victims of a data breach at ChoicePoint announced in early 2005.
634300
North American banks and retailers warn Banks and retailers in the United States and Canada have begun to report an increasing amount of illicit transactions thought to be linked to the server breach announced last week by the TJX Companies, the commercial giant that owns retail chains in the US, Canada, and Europe.â¦
23018
ID theft milestone reached The total number of US customer records compromised as a result of security blunders has hit the 100m milestone.â¦
719033
Online brokerage TD Ameritrade Holding Corp. said Friday one of its databases was hacked and contact information for its more than 6.3 million customers was stolen. A spokeswoman for the Omaha-based company said more sensitive information in the same database, including Social Security numbers and account numbers, does not appear to have been taken.
635335
Data broker ChoicePoint Inc. will pay US$500,000 and has agreed to change the way it screens new customers under a multistate settlement for aÂ 2004 data breach.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
461203
First chips 'on track' for 2005 debut, apparently
234760
(InfoWorld) - Reports of corporate data leaks, lost laptops, and misplaced backup tapes are so commonplace that many no longer warrant a mention in the press. So common are corporate data leaks of one form or another that only the multimegaton events -- TJX, the Veterans Administration, or DuPont -- get covered. But the data leak problem sure has gotten the attention of corporate boardrooms, even if the media has moved on. For proof of that, look no further than the gaggle of data leak prevention companies that has popped up in recent years. We've already heard this month about startup Provilla, as well as Varonis. Code Green Networks is another aspiring startup that hopes to bring high-end data leak prevention technology to smaller and midsize corporations. Founded in late 2004, Code Green is the brainchild of Shreekampt and Sudhakar Ravi, both co-founders of security appliance maker Sonicwall. Started with seed money from its two founders, the company has taken in $32 million in venture funding to date and now has 65 employees, says Chip Hay, senior vice president for marketing and customer care at Code Green. Data leaks aren't just bad publicity for companies, they're also expensive, Hay says. Citing a recent study by the Ponemon Institute, Hay says that lost customer records can cost as much as $182 each to remediate, not counting penalties and legal ramifications from the growing matrix of state and federal data protection and consumer privacy laws. Those factors have stoked enterprise interest in data protection products. "The big change for us in the last nine months is that we've gone from talking to companies who want to get educated, and now they've decided that [they] want to put data leak prevention in place," Hay says. Companies -- especially in fields such as high technology -- are also paying attention to protecting their core intellectual property, especially with outsourcing and complex business partner relationships exposing more and more data, he says. Code Green's flagship product is a content inspection appliance that's installed at egress points on customer networks. The device can inspect SMTP, e-mail, FTP, and IM traffic, among others, and can run in-line to block suspicious traffic or in asynchronous mode to monitor actions and policy enforcement, Hay says. At the heart of Code Green's technology are algorithms that were originally designed to spot plagiarism in different samples of writing, Hay says. That technology, which analyzes content bit patterns, allows Code Green to spot sensitive information without relying on fallible dictionaries of terms, and without regard to the language used to express the sensitive information. That, and the product's support for more than 400 document formats, allows Code Green to sell into markets like Japan and China, Hay says. That's increasingly important, amid concern about rampant intellectual property theft -- some of it state sponsored. For example, one Code Green customer recently reported finding proprietary manufacturing process documents published in a Chinese language publication, Hay says. The company also prides itself on its product's capability to parse message traffic from the sea of Web-based e-mail providers, where no standard message formats are used. Code Green has also forged strategic partnerships with vendors such as Voltage Security for e-mail encryption and with Centennial Software to reach the SMB market. A new version of the Code Green appliance due out soon will offer enhanced data fingerprinting for reading data in relational databases, and structured and flat files -- as well as better content discovery features. The product already sports connectors to Oracle and Microsoft SQL server and EMC's Documentum content management platform.
612363
(InfoWorld) - Computers belonging to the U.S. government, contractors, and companies in the transportation industry were hit by a targeted computer attack in July that yielded password information for hundreds of Internet and intranet Web sites, a computer security vendor said Tuesday. The malicious code behind the attacks was first detected by computer intrusion prevention vendor Prevx on July 5. In total, the criminals were able to cull 200MB ofÂ information from about 500 computers, including password and login data, Prevx said. All but one of the computers was located in the U.S., and many of the computers that were infected were associated with air transportation, according to Mel Morris, CEO of Prevx. "This was a well-coordinated attack by someone wanting to get information on the related sites." PCs at the U.S. Department of Transportation (DOT), American Airlines, and DOT contractor Booz Allen Hamilton all were compromised, Morris said. If DOT systems were compromised, the department is unaware of the situation. "We haven't found any record of a problem," a DOT spokeswoman said Tuesday. Prevx obtained a sample of the Trojan used in the attacks on Friday of last week. By Saturday, it had tracked down a Web site, hosted by YahooÂ in Sunnyvale, California, where information from the compromised PCs was dropped. Because Prevx found a "massive amount" of job applications on the Web site used by the criminals, the company believes that victims may have downloaded the malicious software while thinking they were applying for a job. That Web site, which had probably been hacked by the criminals behind the scam, was shut down on Tuesday, Morris said. It hosted about 200MB of password information, and log-files on the server showed the IP addresses of the infected PCs. Victims of the Trojan, called Win32.PSWSteal.Gen , are told that their hard drive has been encrypted and that they will need to pay $300 to for a decryption tool. Morris believes this extortion threat is actually a ruse designed to conceal the attacker's true motivation: data gathering. "We think the ransomware is to point anyone investigating this down the wrong alley," he said. Morris said he is troubled that such a high percentage of the infected PCs are related to the transportation sector, which has been the target of terrorist attacks. "When we reverse-engineered the IP addresses of those computers, we couldn't believe that this was a daisy chain that led to government-associated sites and to other defense contractors, and to American Airlines," Morris said. "This was a very highly targeted attack." Criminals have increasingly turned to this type of targeted attack in order to collect and eventually sell data from corporations and government agencies, said Marcus Sachs, deputy director of research group SRI International's Computer Science Laboratory. But while Prevx's list of compromised organizations is "kind of scary," it's still hard to characterize what was motivating the attack, Sachs said. "I wouldn't necessarily associate it with terrorists," he said.
755149
(InfoWorld) - A letter from Pfizer Inc.'s attorney to Connecticut Attorney General Richard Blumenthal shows the drug maker first learned of a data breach involving about 17,000 of its employees on April 18 -- six weeks before the company started notifying them of the incident on June 1. The July 11 letter, signed by Bernard Nash of Dickstein Shapiro LLP, also said that that a "small group" of additional individuals may have been affected by the breach, in addition to the 17,000 that were originally reported. Nash's letter, which was posted online by New London, Conn.-based The Day, was in response to a note Blumenthal has sent on June 6 to Pfizer. In it Blumenthal sought a full explanation of the circumstances surrounding the breach, in which personal data belonging to about 17,000 Pfizer workers was exposed by a file-sharing program that had been illegally installed on a company laptop. According to Pfizer's original notice, about 15,700 individuals actually had their data accessed and copied by an unknown number of persons on a peer-to-peer network. The company said that while data on the rest of the affected individuals may have been exposed, it could not confirm if the information had actually been copied. Among the issues that Blumenthal sought clarifications on were the measures that Pfizer had in place prior to the breach to protect against data compromises, as well as information about when the company discovered the breach and how it responded to the incident. Blumenthal's letter also asked Pfizer to describe how it was able to make a distinction between the data that was actually copied and data that might only potentially have been accessed. In his formal response on Pfizer's behalf, Nash said that Pfizer learned of the incident on April 18 when an independent computer consultant informed the company that he had found Pfizer data on a peer-to-peer network. The compromise occurred on March 26 when the spouse of a Pfizer employee used the employee's password to access the computer and install an unauthorized file-sharing software program on it, Nash said. He however offered no explanation on why the company waited till June 1 to inform those affected by the breach. "That software was configured by the spouse so that other users of the file-sharing network could access certain files that the spouse had stored in the employees' laptop," Nash said. "Unfortunately, the software configuration also allowed users of the file-sharing network to access certain other files -- Pfizer files -- contained on the laptop," Nash noted in his letter. In addition to the personal data on Pfizer employees, other information pertaining to the company's pharmaceutical sales business and operations was compromised, he said. Some of the users on the file-sharing network who accessed Pfizer files were using newer file-sharing software versions that recorded the fact that certain files had been copied, Nash said. As a result, Pfizer was able to determine which of the files had been actually accessed and copied and which ones may have only been exposed, he added. Nash, however, offered no explanation on why the company waited till June 1 to inform those affected by the breach.
535315
Hackers stole millions of credit card numbers from discount retailer TJX Cos. by intercepting wireless transfers of customer information at two Miami-area Marshalls stores, according to an eight-month investigation by the Canadian government.
93340
TJX Companies was not complying with nine of the 12 security controls mandated by the payment card industry data security standards when cardholder data was breached, according to court filings.
319386
SEPTEMBER 24, 2004  - A distributed denial-of-service attack that disrupted Web-based systems at credit card payment processing firm Authorize.
146471
TJX Cos. now meets credit card security rules, a company spokeswoman said yesterday, putting the Framingham retailer among a growing number of companies catching up with a Sept. 30 deadline to tighten how they handle consumer information.
378646
Monster.com waited five days to tell users its system had been hacked, in a security breach that resulted in the theft of confidential information for more than a million users, a company executive told Reuters yesterday.