Data Breaches Analysis

The Target Corporation has undergone many changes due to the 2013 security breach where hackers stole personal information from credit and debit cards of at least 70 million customers. Target sales and reputation has dropped from this instance, thus eliciting changes in their security systems, changes in management, and a few policy changes in handling customer information. With the public eye on the corporation’s handling of the situation, Target has been communicating these changes through various means. The changes they needed to communicate were informing customers of the security breach, addressing the bad press coverage to shareholders, downsizing of employees, and

What do Premara Blue Cross, Anthem, Chick-fil-A, Sony, USPS, MCX, Staples, Kmart, Dairy Queen, SuperValue, Jimmie John's, Viator, Home Depot, PF Chang's, Community Health Systems, and JP Morgan all have in common? Each of these companies were hacked during 2014-2015. Sadly, this is just a short list showing the breadth of industries and size of operations that are vulnerable. According to Time Magazine in March, 2015, "You're not just imagining it: Lately, a new data breach has been reported almost every week."

During the dates of November 27 through December 2013, the department store Target experienced a data breach in which approximately 40 million customers credit and debit cards were exposed. During this breach, customer’s personal information may have also been exposed for use of possible fraud. January

This section primarily attempts to provide a better understanding as to how the 2013 data breach impacted Target’s finances. Because the breach occurred within Target’s fourth quarter 2013 period—between November 2, 2013, and February 1, 2014—financial analysis was gathered primarily from information provided in Target’s 2013 quarterly reports, 2012 and 2013 annual reports. This analysis will be divided into four parts. The first is an analysis of the company’s quarterly revenues and net earnings and how it measures year-over-year. The second assesses the company’s profitability through ratio analysis. The third segment gauges Target’s 2013 fiscal year performance with that of its biggest competitor, Walmart. The fourth and final segment looks at whether or not Target was able to regain its customers in the years that followed.

One of the largest examples of a technological privacy violation in history was the Target data breach of 2013. The Target Corporation is one of the leading innovators of the retail industry. They introduced the concept of designer partnerships, making them one of the leading clothing stores in the country (Corporate Target 1). Unfortunately, the company was targeted by Russian hackers shortly before the Christmas of 2013. In this hack, personal information, including customer names, mailing addresses, phone numbers, email addresses and credit card information, of seventy million people was stolen and used for fraud (Forbes 1). This has raised concerns over how well the company can ensure that their consumer’s privacy is protected.

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

In the midst of the holiday season, Target shoppers were shocked in December 2013 when the news came out, 40 million Target credit cards had been stolen (Krebs, 2013f) by accessing data on point of sale (POS) systems (Krebs, 2014b). Target later revised that number to include private data for 70 million customers (Target, 2014). The breach transpired between November 27 and December 15th 2014 (Clark, 2014). Over 11 GB of data was stolen (Poulin, 2014). Target missed internal alerts and found out about the breach when they were contacted by the Department of Justice (Riley, Elgin, Lawrence & Matlack, 2014).

In December 2013, Target was attacked by a cyber-attack due to a data breach. Target is a widely known retailer that has millions of consumers flocking every day to the retailer to partake in the stores wonders. The Target Data Breach is now known as the largest data breach/attack surpassing the TJX data breach in 2007. “The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised.” (Timberg, Yang, & Tsukayama, 2013) The data breach occurred to Target was a strong swift kick to the guts to not only the retailer/corporation, but to employees and consumers. The December 2013 data breach, exposed Target in a way that many

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

Target’s initial media communication to the public was ineffective because Target took more than 24 hours to release an announcement about the security breach after the story broke, which destroyed the corporation’s reputation and credibility. According to Eric Dezenhall, the CEO of public relations firm Dezenhall Resources, Brian Krebs reported the first story of Target’s security breach via a blog post on Dec. 18, 2013. Krebs is a national expert, former Washington Post reporter, and credible blogger who have been covering in-depth security news and investigation for more than fourteen years. Krebs alleged, during the past few days, “Target is investigating a data breach potentially involving millions of customer credit and debit card records”

The government and major companies have frequently leaked and misused the public’s information. For example, in Ted Koppel’s 2005 article on “Take My Privacy, Please!”, he mentions how Bank of America lost personal information on about 1.2 million federal government employees, including some senators. LexisNexis unintentionally gave outsiders access to personal files on over 310,000 people. Time Warner

This section primarily attempts to provide a better understanding as to how the data breach impacted the results reported in Target’s financial statements. Because the breach occurred within Target’s fourth quarter 2013 period—between November 2, 2013, and February 1, 2014—financial analysis was gathered from information provided in Target’s 2013 quarterly reports, 2012 and 2013 annual report. This analysis will be divided into four parts. The first is an analysis of the company’s quarterly revenues and net earnings and how it measures year-over-year. The second relates to the costs associated with the data breach. The third assesses the company’s profitability through ratio analysis. The final segments gauge Target’s 2013 fiscal year performance with that of its biggest competitor, Walmart.

There have been a series of high profile data breaches in the last few years, including Home Depot, Target, and T Mobile (Bennett 2015). A hack of Rochester- based insurance provider Excellus BlueCross BlueShield compromised the records of over ten million customers, including medical and credit card data. Although the hack happened at least two years prior, customers were not notified until September of 2015 (Orr 2015). In an effort to prevent data breaches, the FTC will require transparency from companies that collect user information under DATA.

This analysis discusses some issues and requirements to correct these issues that are outlined in the Turn Key University (TKU) data breach case study. In addition to these issues and requirements, some applicable laws will be discussed and some controls will be suggested for implementation.

Data breaches are increasingly common as companies are faced with securing a multitude of networks, devices, applications, users, and files used in the course of conducting business. And with global workforces and the rise of cloud computing, security perimeters are more difficult to define than ever before. These issues combine to create a perfect storm – a climate ripe for hackers to take advantage of. (Lord, 2017) Below are the trending data loss trends to watch out for: