TJX (T.J. Maxx and Marshall’s) Largest Breach of Customer Data in U.S. History

Use Netsparker


This case has been going on for a while but obviously hush hush, being that it is the largest breach of customer data in U.S. History. The details of the case have only started emerging in the last couple of months.

Information Week published a good article covering what has been going on recently.

Amazing the amount of data we are talking about here, 45 million customer records!

TJX will be glad when this year is over. The $17 billion-a-year parent company of T.J. Maxx, Marshall’s, and several other discount retail chains has spent the past eight months dealing with the largest breach of customer data in U.S. history, the details of which are starting to come to light.

Last December, TJX says it alerted law enforcement that data thieves had made off with more than 45 million customer records. Since that time, at least one business, Wal-Mart, has lost millions of dollars as a result of the theft, while TJX has spent more than $20 million investigating the breach, notifying customers, and hiring lawyers to handle dozens of lawsuits from customers and financial institutions. Should TJX lose in the courts, it could be on the hook for millions more in damages.

But there’s an even broader TJX Effect: The data breach, which actually took place over a period of years, has put the entire retail industry on the defensive and stirred up demands for all businesses that handle payment card information to do a better job of protecting it. Legislators are invoking TJX’s name to fast-track data-security bills.

Years? That’s scary, how can something like this happen? I can’t blame the retail industry for being shaken up. Credit card information does need to be safeguarded.

I hope legislation is approved to hold companies that leak data like water in a sieve, they should be fined some big cash and made to compensate every consumer that was negatively effected by fraudulent use of their credit cards.

Poorly secured in-store computer kiosks are at least partly to blame for acting as gateways to the company’s IT systems, InformationWeek has learned. According to a source familiar with the investigation who requested anonymity, the kiosks, located in many of TJX’s retail stores, let people apply for jobs electronically but also allowed direct access to the company’s network, as they weren’t protected by firewalls. “The people who started the breach opened up the back of those terminals and used USB drives to load software onto those terminals,” says the source. In a March filing with the Securities and Exchange Commission,TJX acknowledged finding “suspicious software” on its computer systems.

The USB drives contained a utility program that let the intruder or intruders take control of these computer kiosks and turn them into remote terminals that connected into TJX’s networks, according to the source. The firewalls on TJX’s main network weren’t set to defend against malicious traffic coming from the kiosks, the source says. Typically, the USB drives in the computer kiosks are used to plug in mice or printers. The kiosks “shouldn’t have been on the corporate LAN, and the USB ports should have been disabled,” the source says.

A pretty basic attack eh? Can you believe they were so negligent in setting up the kiosks? They virtually allowed full access to their corporate network!

Public resources should never have access to the same segments critical data are stored on…this is basic stuff!

They also owned via open Wifi networks in Marshall’s stores…sad eh?

Source: Information Week

Posted in: Hacking News, Legal Issues

, , , , ,


Latest Posts:


NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.
Powershell-RAT - Gmail Exfiltration RAT Powershell-RAT – Gmail Exfiltration RAT
Powershell-RAT is a Python-based Gmail exfiltration RAT that can be used a Windows backdoor to send screenshots or other data as an e-mail attachment.
SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants etc.
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.
Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.


One Response to TJX (T.J. Maxx and Marshall’s) Largest Breach of Customer Data in U.S. History

  1. Sir Henry December 14, 2007 at 7:41 pm #

    What I find to be equally frustrating is that, so far, there does not seem to be any idea correlation between the hashing of passwords and the hashing of cc numbers. Perhaps I am wrong, but it just seems like it would be logical to do that.