TJX e-mails tell the tale
Posted On Thursday, November 29, 2007 at at 11/29/2007 06:06:00 AM by nullExecutives at TJX Cos., which in January revealed a massive security breach that put millions of its customers’ personal information at risk, knew two years ago that the company’s wireless payment network was vulnerable to attack, according to court documents.
In 2005, TJX officials also discussed the need to update the company’s wireless network security to a more secure WiFi protected access (WPA) system and whether it could be deferred to save money, according to e-mail exchanges between TJX employees. The e-mails were included in court documents filed in a lawsuit brought by a group of banks against TJX.
The security breach, the nation’s largest, began in mid-2005 and was discovered by TJX in late 2006. TJX has since been accused of failing to safeguard customers’ information and faces a myriad of lawsuits. Canadian officials who conducted their own investigation said criminals hacked into TJX’s wireless networks while outside two Marshalls stores in Miami.
The e-mails reveal TJX executives’ concerns about the network.
“WPA is clearly best practice . . .” Paul Butka, TJX’s chief information officer, wrote in a Nov. 23 e-mail to other TJX employees. “I think we have an opportunity to defer some spending from FY ’07’s budget by removing the money from the WPA upgrade, but I would want us all to agree that the risks are small or negligible.”
In response, TJX employee Lou Julian sent an e-mail saying, “Saving money and being PCI compliant is important to us, but equally important is protecting ourselves against intruders.”
Julian wrote that the company was “vulnerable” with the wired-equivalent privacy encryption (WEP) standard it had in place. “It must be a risk we are willing to take for the sake of saving money and hoping we do not get compromised,” he wrote.
TJX vice chairman Donald Campbell in a statement said that TJX’s computer security prior to the breach was “similar to that of other large retailers.”
“These TJX internal e-mails are just a very small portion of the extensive, ongoing dialogue on the topic of WPA wireless network security and timing of spending which occurred at TJX,” Campbell said.
“TJX decided to move to WPA in advance of being required to do so by the payment card industry. Spending on WPA conversion was not deferred by TJX; in fact, it was accelerated and TJX completed conversion to WPA in advance of its conversion timetable and ahead of many major retailers.”
Consumer losses from ID theft falling?
Posted On at at 11/29/2007 06:06:00 AM by null The U.S. Federal Trade Commission released a report on Tuesday that showed a significant drop in the losses due to identity theft, but also noted that changes in the survey questions could have caused the decreased. The survey, the 2006 Identity Theft Survey Report (PDF), estimated that losses from stolen and fraudulent credit accounts reached $15.6 million, only a third of the $47.6 billion cited in a 2003 survey. However, the report does not rule out the possibility that statistical errors and a change in methodology could have caused the significant drop. The 2006 survey typically asked more specific questions in regards to losses compared to the 2003 survey, the report stated. "Although we believe that these methodological changes improve the reliability of the estimated values, they tend to cause lower estimates as compared to the 2003 survey," analyst firm Synovate, the author of the report, stated in the document. "Thus, the differences in the estimates between 2003 and 2006 may, at least in part, be due to the changes in methodology as opposed to changes in consumers' actual experiences." The survey found that identity thieves gained more goods and services -- and thus, consumers lost more -- through opening new, fraudulent accounts in the victim's name, rather than fraudulently using existing accounts. On average, identity thieves stole $1,350 in goods and services through new accounts, compared with $350 using existing accounts. For the worst-hit 10 percent of victims, the average loss was $15,000 for new accounts versus $4,000 for existing accounts. On average, there were no out-of-pocket expenses for victims. The FTC stressed that even with the lower estimates, identity theft remains a significant problem. "The important thing is that people learn how to deter identity thieves, detect suspicious activity on their financial records, and defend against the crime, should it happen," Lydia B. Parnes, director of the FTC's Bureau of Consumer Protection, stated in a press release. Concerns over identity theft and credit-card fraud has risen in recent years because of the public outing of high-profile cases, such as retailer TJX Companies' loss of information on more than 94 million credit- and debit-card accounts. Stores have become increasingly worried about the liability of storing credit-card data. Recent arrests of suspected identity thieves has underscored the increasing sophistication of the groups dealing in such information. A survey of those arrested for identity theft found that the majority have never before been accused of a crime. The 2006 Identity Theft Survey Report is based on 4,917 interviews conducted in between March and June of 2006.