Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[Dataloss] followup: Customer Data Breach Began in 2005, TJX Says (fwd)
From: security curmudgeon (jerichoattrition.org)
Date: Fri Feb 23 2007 - 03:53:36 CST
---------- Forwarded message ----------
From: InfoSec News <alertsinfosecnews.org>
Subject: [ISN] Customer Data Breach Began in 2005, TJX Says
By Ellen Nakashima
Washington Post Staff Writer
February 22, 2007
Retail giant TJX, whose stores include discount clothing chains T.J. Maxx
and Marshalls, said yesterday that a computer-security breach stretched
back 10 months earlier than the company originally thought, compromising
credit and debit card data, drivers' license numbers, and names and
The announcement underscores a trend of security breaches involving
sensitive credit card data and reflects failures to properly secure
computer systems, to notify customers when breaches occur and to update
laws for the cyber-crime age, lawmakers and analysts said.
TJX said that while it first thought the intrusion took place from May
2006 to January 2007, it now thinks its computer system was also hacked in
July 2005 and on "various subsequent dates" that year. The company, which
reported the intrusion in January -- a month after it said it discovered
the breach -- has not said how many customers may have been affected or
how many customers it has notified.
"We don't have a number for you there. Our work is not finished,"
spokeswoman Sherry Lang said yesterday. More than 50 computer experts are
helping TJX investigate the breaches, she said.
Banks that issued the credit cards have not said how much they have had to
cover in fraud-related losses.
More than 30 states have laws that require companies to notify customers
as soon as possible when a breach has occurred, though most of the
statutes let companies delay notification while law enforcement agencies
investigate. A bipartisan group of senators has reintroduced legislation
that would mandate customer notification and require companies that
maintain personal information to establish internal policies to protect
"Americans live in a world where their most sensitive personal information
can be accessed and sold to the highest bidder, with just a few keystrokes
on a computer, yet our privacy laws haven't kept pace," Sen. Patrick J.
Leahy (D-Vt.) said in a statement when the legislation was reintroduced
The credit card industry has set up rules for data protection called the
Payment Card Industry Data Security Standard. They include encrypting
transmission of cardholder data, regularly testing security systems and
processes, and restricting access to data to those with a "need to know."
But most large retailers have not complied with the standard, and
noncompliance is about 80 percent among smaller retailers, said Avivah
Litan, an analyst with Gartner, an information technology research firm.
Litan said the retailers are not solely to blame. "It's a collective
problem with collective responsibility," she said. "Certainly the
retailers have to tighten up their systems, but the banks have to
strengthen cardholder authentication so even if the data is stolen, it's
Security breaches are difficult to quantify accurately. The Privacy Rights
Clearinghouse, a nonprofit research and advocacy group in San Diego, said
more than 100 million records of U.S. residents have been exposed by
security breaches since February 2005.
The privacy group and the nonprofit Identity Theft Resource Center, also
in San Diego, found that the majority of breaches they have tracked in the
past few years occurred in government, the military and universities.
One of the biggest breaches occurred in 2005, when 40 million credit card
numbers, along with name and account information, were exposed by hackers
who broke into CardSystems Solutions, a credit card processing center that
handled transfers of payments between the banks that issue credit cards
and the merchants' banks.
Retailers often keep more data than necessary to process transactions,
Litan said. They also keep information longer than necessary, she said.
"The CEOs and senior managers of most retailers that are storing data,
like TJX, have no idea they're storing that data," Litan said. "It's
basically a legacy of old systems programming." Many retailer systems were
built in the 1970s and '80s, before there were hackers.
Many banks are frustrated because they are "left having to pay for the
mistakes of retailers," to cover reissuing cards and any losses due to
fraud, said Nessa Feddis, senior federal counsel for the American Bankers
"Retailers are not protecting the data," she said. "It's not a question of
notification. It's a responsibility to protect the data."
The bankers typically do not know the scope of retailer breaches because
of confidentiality agreements between the retailers and the issuing card
companies, such as Visa and MasterCard.
In Massachusetts, where TJX is headquartered, the Massachusetts Bankers
Association stopped surveying its members in connection with the TJX
breach after more than 30 banks were alerted by Visa and Master Card that
their cards had been compromised by the TJX intrusion, association
spokesman Bruce Spitzer said.
TJX operates more than 2,400 stores in the United States, Canada and
Europe. They accept Visa, MasterCard, American Express and Discover credit
The company reported yesterday that same-store sales in the fourth quarter
rose 5 percent from the comparable quarter a year earlier. The quarter
ended Jan. 27, 10 days after the breach was disclosed.
TJX, which is being sued by customers and banks, also reported that it
spent $5 million in the fourth quarter to cover costs of the
investigation, enhance computer security and communicate with customers.
Fourth-quarter profit fell 29 percent, to $205.5 million. Sales rose 9
percent, to $5.1 billion. For the full fiscal year, TJX profit rose 7
percent, to $738 million. Sales rose 9 percent, to $17.4 billion.
Copyright 2007 The Washington Post Company
Dataloss Mailing List (datalossattrition.org)
Tracking more than 149 million compromised records in 580 incidents over 7 years.