Boss, I Think Someone Stole Our Customer Data

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

The Target Corporation has undergone many changes due to the 2013 security breach where hackers stole personal information from credit and debit cards of at least 70 million customers. Target sales and reputation has dropped from this instance, thus eliciting changes in their security systems, changes in management, and a few policy changes in handling customer information. With the public eye on the corporation’s handling of the situation, Target has been communicating these changes through various means. The changes they needed to communicate were informing customers of the security breach, addressing the bad press coverage to shareholders, downsizing of employees, and

Companies have an obligation to protect their customer’s information, which goes beyond that of complying with state and federal regulations. If the company loses the trust of their customers, they risk the chance of damaging

The purpose of this meeting is to inform you of a security breach that occurred in our company, and to inform you of what has been affected, how we found out, and what measures have been used to correct and prevent this from happening again. The following is a bulleted list of relevant information related to the security breach.

The Roaring Fork Valley Physicians, IPA, Inc., a Corporation violated Federal Trade Commission (FTC) Act’s Section 5. This Roaring Fork Valley Physicians, IPA, Inc., a Corporation was connected to approximately 80 percent of the doctors of the Garfield County, Colorado. The Federal Trade Commission (FTC) Act’s Section 5 stands for 15 USC 45. This act prohibits any unfair or deceptive act in practice in or affective commerce. This law is applicable to all the individuals who are related to the commerce and includes banks too. (1)

The first point of analysis is related to National Data Breach reporting which main goal is to protect consumers against identity theft and incentivize businesses for better cyber security. Businesses are required to inform the consumers if the intruder had access to the consumers’ personal information in order to prevent further damage or loss. The information security policy of State of Maryland is set forth to provide any data breach incident

What do Premara Blue Cross, Anthem, Chick-fil-A, Sony, USPS, MCX, Staples, Kmart, Dairy Queen, SuperValue, Jimmie John's, Viator, Home Depot, PF Chang's, Community Health Systems, and JP Morgan all have in common? Each of these companies were hacked during 2014-2015. Sadly, this is just a short list showing the breadth of industries and size of operations that are vulnerable. According to Time Magazine in March, 2015, "You're not just imagining it: Lately, a new data breach has been reported almost every week."

Through out 1990, F & C systematically overstate sales revenue by backdating valid sales transactions, shipping customer’s products they had not ordered, and recording bogus sales transactions. To overstate inventory, F & C personnel filled barrels with water and then labeled those barrels as containing high-concentrate flavor products. The company also neglected to write off defective goods and included waste products from manufacturing process in inventory. Company officials used F & C’s misleading financial statements to sell equity securities and to obtain significant bank financing.

Popular tech security website krebsonsecurity.com first reported a rumored data breach at Target on December 13 after receiving tips

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

Ms. Jones advised on 12/06/2015, an unknown suspect used a cloned copy of her Central Florida Credit Union ATM/Debit card number 5460-2551-5028-7615 to make four unauthorized purchases at Invicta Store #016, 8001 South Orange Blossom Trail, Orlando, Florida in the amounts of $524.14, $134.88, $98.67 and $202.78.

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

Facts: On 11/28/16, APM Orlando revived CCTV Footage to confirm this allegation. CCTV Footage revealed that SVC Moctezuma-Rivera scanning a Balance Rewards card that was placed under the monitor of the terminal during customers transactions.

The less sophisticated thieves have perfected the art of “dumpster-driving” rummaging through trash. Abusing employer’s authorized access to credit reports or some even playing ‘landlord’ has given them unauthorized access to victim’s reports. Some victims have been scammed fro information by an identity thief posing as a legitimate businessperson or government official. In the most recent news from Concord, NC (Aug. 19, 2004), the police have uncovered a more sophisticated case of ID theft. The newspapers stated, “Authorities think a portable credit card reader, or skimmer, was used to read personal information off a credit card’s magnetic strip. Then those details were applied to the strip on the back of a different cared.”

All the consumers affected were also made vulnerable to subsequent identity theft given malicious attackers stole their personal data. Equifax was directly affected since its stock began to plunge immediately the news was made public. Additionally, the corporate governance of the company was tarnished given three Equifax executives sold shares worth around $2 million days after the breach discovery, and the “retiring” of the chief security information officers is questionable (Surane & Melin, 2017). Also, the company was exposed to litigations with some lobbyists and interest groups pushing regulators to hold Equifax accountable for the negligence and poor treatment of affected consumers. The proposed new data security laws will present a greater burden to other corporations. Two such laws are the Promoting Responsible Oversight of Transactions and Examinations of Credit Technology (PROTECT), and Freedom From Equifax Exploitation (FREE) will attract more government scrutiny and limit the type of personal data that companies can collect from customers (Alperan, Carter, & Sofio, 2017).