Goodwill Breach Paper

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

The Target Corporation was exploited in December 2013 and then again in 2015. These breaches included customer’s personal identifying information and retailer’s data. This credit card data breach is a prime example of weak security and infrastructure. This breach happened over the course of one of the United States’ major holiday seasons, Christmas. The security issue involved hackers accessing Target’s customer 's credit and debit cards by the machines that were being used to swipe the cards. These hackers accessed Target’s network with a stolen username and password from a company that was providing refrigeration and HVAC services. This company could access Target’s network `remotely to monitor energy consumption and temperatures. With that, the hackers uploaded malware software on the Target’s credit card machines. The customer data hack happened across the nation, and it was performed in stores and not an online breach of Target customer information.

An unauthorized and highly sophisticated malware that not been encountered previously by any security company attacked the point-of-sale systems where all the card information is stored. The outcome of this hacking been extensive and affected millions of customer’s personal and payment data was exposed, results in the payment card compromise of three million customers.

Michael’s Store, Inc. is an arts & crafts Retail chain. It has more than 1040 stores located in 49 US states & Canada. The company also owns and operates the Aaron brother’s retail chain, which happens to have an additional 115 stores across the Country. Michael’s store Inc. had a Security breach, which took place between May 8, 2013 and January 27, 2014. About 2.6 million cards or about 7 percent of payment cards used at its stores during the period were affected. Alarmingly, its subsidiary Aaron brothers also had been breached between June 26, 2013 and February 27, 2014. It was reported that Aaron brothers had 400,000 cards impacted. The duration of the treacherous attack in total was 8 months (Schwartz, 2014). In this report, security breach of Michael’s store Inc. is analyzed. The topics covered are how the breach occurred, what did the authorities do to educate the customers & how in future such attacks can be avoided.

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

In the midst of the holiday season, Target shoppers were shocked in December 2013 when the news came out, 40 million Target credit cards had been stolen (Krebs, 2013f) by accessing data on point of sale (POS) systems (Krebs, 2014b). Target later revised that number to include private data for 70 million customers (Target, 2014). The breach transpired between November 27 and December 15th 2014 (Clark, 2014). Over 11 GB of data was stolen (Poulin, 2014). Target missed internal alerts and found out about the breach when they were contacted by the Department of Justice (Riley, Elgin, Lawrence & Matlack, 2014).

Last year, The US retailer, Target, reported that there were almost forty million transaction information been stolen by hacker. Those information include card numbers, name, expired date and security code, and the information can be used for making counterfeits. The theft seriously damaged Target’s reputation and shareholders' equity. According to the CNN news, Target might loss $148 million in this accident.

In late 2013, news headlines and social media outlets were reeling with the news that Target encountered a cyber-attack that breached the credit card accounts of millions of customers who shopped within the brick and mortar stores during the holiday shopping season. Hackers not only gained access to credit cards numbers, but also other personal data such as email addresses and names (Kinicki & Williams, 2016, p.38). The Target case study explores the dilemma that Target CEO Gregg Steinhafel faced with how to rebound from the very damaging breach. Against the advance of top advisors to Mr. Steinhafel opted for full disclosure to the public. Though a very risky choice, Mr. Steinhafel made a very appropriate decision from a business perspective,

This paper explores the cyberattack that compromised JPMorgan Chase & Co. around the summer of 2014 both in how the reported intrusion occurred and the aftermath of the event. The paper will report on the method the hackers used to gain access to the PII (Personal Identifying Information) of millions of JPMorgan Chase customers and clients both current and former,

The data breach at TJX happened because TJX did not performance its due diligence in protecting customers’ financial information. TJX did not follow and meet all of PCI DSS requirements that put company’s and customers’ data as risk. The company was still using WEP which was outdated and vulnerable against hackers instead of choosing WAP2. The encryption was weak and not able to protect itself against the intrusion. TJX also made another mistake by storing unnecessary customers’ data since 2002 which allowed hackers to trace far back to transactions happened in 2002. In fact, TJX should be responsible for the breach by not taking IT security according to its standards. TJX got into this type of situation because they did not realize how

A recent article by David Pitt of the Associated Press discusses how a Minnesota court is now re-reviewing the 10 million dollar settlement Target made back in 2015 (Pitt, 2017). The article states that the breach ultimately affected 100 million customers of Target and that has been determined that consumers are being left with no reimbursement for the breach settlement after legal fees were accessed (Pitt, 2017). Per documents accessed from the settlement trial, 41.9 Million consumers at Target in 2013 had financial information stolen, while 60 million consumers had to deal with the fallout of personal information being compromised (Pitt, 2017). Pitt (2017) also states that an attorney for Target customers, openly acknowledged in court that 99 percent of the customers included in the class-action lawsuit will get no compensation from the settlement. (2017). A breach of this size can put into perspective the importance of stronger cyber security and up to date systems for companies. The real issue for consumers, is that over 3 years after the Target breach occurred, those consumers may still not receive any reimbursement for their stolen information and fraud that the breach caused which can further reinforce why cyber security is so

In a statement released on 6th February, 2015, Anthem Inc, the largest for profit managed healthcare company in the Blue Cross and Blue Shield Association released a statement that they were target of very sophisticated external cyber-attack. Apparently attackers gained unauthorized access to Anthem’s IT system and have obtained personal information of their current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data. Highly confidential information of as many as 80 million individuals was compromised in what is the largest known breach of a healthcare company. According to Bloomberg experts, Anthem first detected unusual activity inside its network on Jan. 27, 2015 and verified the intrusion on Jan. 29, 2015. The company has yet to disclose when the initial intrusion began. Anthem CIO, Thomas Miller informed a leading journal that “the attack was first noticed when an administrator found that his database identifier code was being used to run database queries that he hadn 't launched. He says the company 's investigators found that the data had been exfiltrated to a popular online storage site”. According to the study which was conducted by a firm, U.S. and

Within the past year, there have been many credit and debit card hackings that have occurred, mainly targeting businesses in the United States. The three main businesses that have been targeted and successfully hacked have been Target, with 40 million card holders having their cards compromised, JPMorgan Chase, with a total of 76 million households and 7 million businesses being compromised, and The Home Depot, with 56 million card holders being attacked (Silver-Greenberg, Goldstein, Perlroth). In addition to the main stories about hacking that everyone hears about, there are many others that are never brought to the attention of consumers. Within the first half of 2014 alone, there were 76 breaches solely in the United States that caused credit card numbers to be compromised (Newsham). Learning about these situations struck me as extremely intriguing and lead me to want to learn even more about these hacking situations. In researching about this topic and looking in depth at all the information I found, I discovered that there are many other subtopics that interested me as well, including consumer hacking in general, how credit cards work, what technology is needed for credit cards to work, how information is stored safely within companies to prevent hacking, the technology behind hacking, the main programs used within hacking, if, and how, social media has effected hacking, learn more about what big name companies and bank franchises should be doing in

One of the largest family oriented chain superstores in the United States gave upwards of 40 million credit and debit card numbers and up to 70 million pieces of personal customer information to a hacker group. On November 27th 2013 the household name of Target, the local one-stop shop superstore, was hacked. A hacker group from outside of the United States used third party credentials from a HVAC company used by Target to gain access to the company’s network. After gaining unauthorized access to Target’s network, the hackers installed a malware on the system to capture all credit card data and customer information given at the registers located in the company’s 1,797 U.S. stores. Once the information was captured by the hackers, the data was then sent to several off-site server locations around the U.S. to cover their tracks. From there, the hackers devised an escape route for the data to reach their servers located in an undisclosed location in Russia. The hacker group will most likely sell the customer data on the deep web to other criminals for just a few dollars per credit card number (Riley). Target could have stopped the hacker group in their tracks foiling their plan of escape with millions of pieces of customer data.