TJX to pay $9.75 million for data breach investigations

TJX Companies, Inc., which has undergone a barrage of lawsuits as a result of a massive data breach of its systems, agreed to pay $9.75 million, settling a lawsuit brought on by Attorneys Generals from 41 states.
This was a self inflicted wound and certainly TJX has done a lot of work since the breach, but the breach itself was the result of poor processes and negligence Jon Oltsik,senior analyst, Enterprise Strategy Group
The parent company of T.J. Maxx and Marshall stores, disclosed in January 2007 that its systems were hacked, exposing at least 45.7 million credit and debit cards to possible fraud. Under the terms of the settlement, the company will pay $2.5 million to create a data security fund for states and a settlement amount of $5.5 million and $1.75 million to cover expenses related to the states' investigations.
In addition, TJX said it agreed to certify that TJX's computer system meets detailed data security requirements specified by the states; and encourage the development of new technologies to address systemic vulnerabilities in the U.S. payment card system.
"Under this settlement, TJX and the Attorneys General have agreed to take leadership roles in exploring new technologies and approaches to solving the systemic problems in the U.S. payment card industry that continue to plague businesses and institutions and that make consumers in the United States worldwide targets for increasing cyber crime," Jeffrey Naylor, chief financial and administrative officer of TJX said in a statement.
Naylor reiterated TJX stance throughout the incident that the company did not violate any consumer protection or data security laws. "The decision to enter into this settlement reflects TJX's desire to concentrate on its core business without distraction and to promote cyber security measures that will benefit all consumers," the company said.
PCI DSS:
Video - PCI compliance requirement 4: Encrypt transmissions: Diana Kelley and Ed Moyle of Security Curve review PCI compliance requirement 4: "Encrypt transmission of cardholder data across open, public networks."Cybersecurity hearing highlights inadequacy of PCI DSS: Lawmakers call the PCI standard lacking and seek significant improvements to the payment processing infrastructure to enhance security.Heartland breach highlights PCI limitations: The benefits of complete PCI and the necessity of full compliance are now being widely questioned, says Eric Ogren, principal analyst, The Ogren Group.
According to investigators, over an 18-month period, hackers exploited a hole in TJX's Wi-Fi network and used a modified sniffer program to monitor and capture data from TJX's transaction systems. Investigators said TJX was using the Wired Equivalent Privacy (WEP) encryption protocol, an older security standard. Wi-Fi Protected Access (WPA) replaces the original WEP security standard. It is compatible with the latest standard, IEEE 802.11i, referred to as WPA2.
Eleven indictments were announced by the United States Attorney in 2008. To date, two of those indicted have pled guilty and two other individuals have pled guilty to related charges.
"This was a self inflicted wound and certainly TJX has done a lot of work since the breach, but the breach itself was the result of poor processes and negligence," said Jon Oltsik, senior analyst, Enterprise Strategy Group.
Although TJX had become the poster child of what could happen when a company suffers a massive breach, Oltsik said it will likely take a breach of intellectual property and other sensitive data that puts a company out of business, before every firm takes data security seriously. There have been other massive breaches since, Heartland Payment Systems is in the midst of a data breach investigation affecting millions of cardholders and Hannaford Supermarket investigators discovered malware that bilked 4.2 million credit and debit card numbers from the grocer's systems.
"The difference between TJX and any other company is just the luck of the draw. They had areas where they were not compliant with PCI but most companies do if you look close enough," said Ed Moyle, cofounder of IT consultancy Security Curve, security solutions manager at integrator CTG. "Some of these environments are quite complex, especially with brick and mortar retail outlets."
The Payment Card Industry Data Security Standards (PCI DSS) have addressed security of cardholder data. But Oltsik said its unclear how much fraud there is in the audit process as there is relatively little oversight from people outside the payment transaction industry.
"PCI is a pretty good first start, but there's plenty of room for abuses and for fraud," Oltsik said.