[ad]<\/p>\n
This case has been going on for a while but obviously hush hush, being that it is the largest breach of customer data in U.S. History. The details of the case have only started emerging in the last couple of months.<\/p>\n
Information Week published a good article covering what has been going on recently.<\/p>\n
Amazing the amount of data we are talking about here, 45 million customer records!<\/p>\n
TJX will be glad when this year is over. The $17 billion-a-year parent company of T.J. Maxx, Marshall\u2019s, and several other discount retail chains has spent the past eight months dealing with the largest breach of customer data in U.S. history, the details of which are starting to come to light.<\/p>\n
Last December, TJX says it alerted law enforcement that data thieves had made off with more than 45 million customer records. Since that time, at least one business, Wal-Mart, has lost millions of dollars as a result of the theft, while TJX has spent more than $20 million investigating the breach, notifying customers, and hiring lawyers to handle dozens of lawsuits from customers and financial institutions. Should TJX lose in the courts, it could be on the hook for millions more in damages.<\/p>\n
But there\u2019s an even broader TJX Effect: The data breach, which actually took place over a period of years, has put the entire retail industry on the defensive and stirred up demands for all businesses that handle payment card information to do a better job of protecting it. Legislators are invoking TJX\u2019s name to fast-track data-security bills.<\/p><\/blockquote>\n
Years? That\u2019s scary, how can something like this happen? I can\u2019t blame the retail industry for being shaken up. Credit card information does need to be safeguarded.<\/p>\n
I hope legislation is approved to hold companies that leak data like water in a sieve, they should be fined some big cash and made to compensate every consumer that was negatively effected by fraudulent use of their credit cards.<\/p>\n
Poorly secured in-store computer kiosks are at least partly to blame for acting as gateways to the company\u2019s IT systems, InformationWeek has learned. According to a source familiar with the investigation who requested anonymity, the kiosks, located in many of TJX\u2019s retail stores, let people apply for jobs electronically but also allowed direct access to the company\u2019s network, as they weren\u2019t protected by firewalls. \u201cThe people who started the breach opened up the back of those terminals and used USB drives to load software onto those terminals,\u201d says the source. In a March filing with the Securities and Exchange Commission,TJX acknowledged finding \u201csuspicious software\u201d on its computer systems.<\/p>\n
The USB drives contained a utility program that let the intruder or intruders take control of these computer kiosks and turn them into remote terminals that connected into TJX\u2019s networks, according to the source. The firewalls on TJX\u2019s main network weren\u2019t set to defend against malicious traffic coming from the kiosks, the source says. Typically, the USB drives in the computer kiosks are used to plug in mice or printers. The kiosks \u201cshouldn\u2019t have been on the corporate LAN, and the USB ports should have been disabled,\u201d the source says.<\/p><\/blockquote>\n
A pretty basic attack eh? Can you believe they were so negligent in setting up the kiosks? They virtually allowed full access to their corporate network!<\/p>\n
Public resources should never have access to the same segments critical data are stored on\u2026this is basic stuff!<\/p>\n
They also owned via open Wifi networks in Marshall\u2019s stores\u2026sad eh?<\/p>\n
<\/p>\n