Heartland Data Breach: A Case Study

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

Data security; affinion security center augments data breach solution. (2012). Information Technology Newsweekly, , 91. Retrieved from http://search.proquest.com/docview/926634711?accountid=458

This paper explores seven references that report the results from research conducted on-line regarding the 2013 Target breach. According to the website “Timeline of Target 's Data Breach And Aftermath: How Cybertheft Snowballed For The Giant Retailer” (2015), the breach occurred November and December 2013 in which customers who shopped at Target locations credit and debit cards were breached and their personal information was exposed. Upon their investigation, it was determined their point of sale system was hacked. “Wikipedia” states point of sale system which is used by third party vendors has cash registers as well as barcodes which stores customer’s information. The website “What is Packet Sniffer” (2016), Packet Sniffing may have been a way the attacked happened. “RAM Scraping Attack” website indicates what RAM means and how this type of attack happens. “What is a Firewall in Networking and How They Protect Your Computers” (2014), “What is Endpoint Security? Data Protection 101” and “Why SSL? The Purpose of using SSL Certificates” websites each provide ways to reduce and/or prevent future attacks.

The Target Corporation was exploited in December 2013 and then again in 2015. These breaches included customer’s personal identifying information and retailer’s data. This credit card data breach is a prime example of weak security and infrastructure. This breach happened over the course of one of the United States’ major holiday seasons, Christmas. The security issue involved hackers accessing Target’s customer 's credit and debit cards by the machines that were being used to swipe the cards. These hackers accessed Target’s network with a stolen username and password from a company that was providing refrigeration and HVAC services. This company could access Target’s network `remotely to monitor energy consumption and temperatures. With that, the hackers uploaded malware software on the Target’s credit card machines. The customer data hack happened across the nation, and it was performed in stores and not an online breach of Target customer information.

This case study, written in 2009 is not the only case where a major data breach has occurred within organizations. In the late 2011 Sony’s PlayStation Network (PSN) was breached impacting up to 77 million user’s accounts including data on names, address and possibly credit card details. In late 2013 Target had a cyber-attack that compromised a large quantity of its data and had 110 million accounts compromised. Finally in September 2014 Apple had their iCloud server breached by hacking that compromised all the users of the online server. These occurrences still have some unanswered questions and several experts have yet to decipher the actual reason as to why the security breach occurred.

From November 27 to December 15, 2013 Target Corporation released 70 million customers’ personal information. On average, it takes companies 200 days to uncover they are being hacked (Lunden, 2015). It only took Target 12 days to figure out the crisis that began happening. On December 19, Target originally said only 40 million credit and debit card accounts may have been compromised during Black Friday weekend to December 15. “The information stolen included customer names, credit or debit card number, and the card’s expiration date and CVV” (McGrath, 2014). Although Target never clarified how they were hacked, security experts say that hackers targeted their POS system. “Target spent $61 million through Feb. 1 responding to the breach, according

Michael’s Store, Inc. is an arts & crafts Retail chain. It has more than 1040 stores located in 49 US states & Canada. The company also owns and operates the Aaron brother’s retail chain, which happens to have an additional 115 stores across the Country. Michael’s store Inc. had a Security breach, which took place between May 8, 2013 and January 27, 2014. About 2.6 million cards or about 7 percent of payment cards used at its stores during the period were affected. Alarmingly, its subsidiary Aaron brothers also had been breached between June 26, 2013 and February 27, 2014. It was reported that Aaron brothers had 400,000 cards impacted. The duration of the treacherous attack in total was 8 months (Schwartz, 2014). In this report, security breach of Michael’s store Inc. is analyzed. The topics covered are how the breach occurred, what did the authorities do to educate the customers & how in future such attacks can be avoided.

On September 8, 2015, it was discovered that a Patriot Financial Services (PFS) employee, whom provided customer support services to clients, had stolen personal financial data from approximately 50K of their customers. The data stolen by this employee was comprised of personal customer information including full names, home addresses, social security numbers, contact numbers, bank account numbers, driver 's license numbers, birth dates, email addresses, mother 's maiden names, pin’s and account balances. The suspect employee then proceeded to leak out this

In the middle of the holiday season, Target shoppers were knocked off their feet with the news that in December 2013 that 40 million Target credit card numbers had been stolen (Krebs, 2013f) by someone accessing Target’s data on their point of sale (POS) systems (Krebs, 2014b). To make matters worst Target later revised their number to include the private data for 70 million of their customers (Target, 2014). The breach took place period of November 27 through December 15th 2013 (Clark, 2014). Target had gotten taken for over 11 GB of their data that had been stolen (Poulin, 2014). Target did not catch their internal alerts and was informed about the breach when they were contacted by the Department of Justice (Riley, Elgin,

Aside from the Playstation Outage, there had been larger and more nefarious data breaches in history that exploited weaknesses in internet, server, and network security. One such breach is when Heartland Payment Systems had, what was called, the most massive credit card security breach in history, with hackers embedding deep into Heartland security and recording card data. According to Bloomberg Business, it was estimated that “as many as 100 million cards issued by more than 650 financial services companies may have been compromised”. The attack cost Heartland $12.6 million, which was orchestrated by a man named Albert Gonzalez, who was also the cause for several other data breaches, each costing from thousands to millions of dollars. Another such attack was when Russian, and a Ukrainian, computer hackers assaulted NASDAQ stock exchange servers and stealing “more than 160 million credit and debit card numbers, target more than 800,000 bank accounts” (NY Daily News). Separate hacking operation spanned over seven years, attacking NASDAQ, but also affected “chains like 7-Eleven”. All the operations, in the period of time and the global scale it spanned, resulted “in at least $300 million in losses to companies and individuals”. One of the latest, and possibly the largest, data breaches of 2015, Anthem, the second largest health insurer in the US was hacked, compromising millions of account and personal data, as well as social security. When Anthem discovered that they had been

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

There are many ways to help prevent breaches such as the Home Depot and the similar Target breach. Most retailers these days have multiple locations possibly in two or more countries like The Home Depot. Because of this the retailers need to know exactly where the business of the organization is being conducted. These organizations need to take the extra steps and know where the customer data is at all times especially payment information. They need to keep track of how it is being accessed and how it is being secured. Tom Bain, who is a senior vice president at a company called Security CounterTack, says “Retailers need to get a better grasp on who is being granted access to their networks and why” (Vijayan). Home Depot failed to do this on a daily basis and this is why the breach was so extensive. People do not know the reason as to why the company did not check these daily logs for payment information but this is the reason that they had such a big breach on their payment systems.

The potential of violations can come from numerous sources (Lawrence & Weber, 2011) (Consumer Information). Recently Equifax had a data breach of their customer’s personal information. The hackers accessed the names, social security numbers, birthdates, and addresses of 142 million American consumers (Consumer Information). This is frightening and happens more often that we think. According to PricewaterhouseCoopers executive, ”Cybercrime has emerged as a formidable threat. Over the years millions have fallen victim to theses attacks. In a survey of 583 U.S. companies, 90 percent said that hackers breached their company’s computers over the last twelve months (Lawrence & Weber, 2011). Cyber crimes occur when hackers attempt to damage or destroy a computer network or system of company’s data. Criminals will use one of the most harmful systems around. This system is called a zombie. A zombie is

Data breaches are increasingly common as companies are faced with securing a multitude of networks, devices, applications, users, and files used in the course of conducting business. And with global workforces and the rise of cloud computing, security perimeters are more difficult to define than ever before. These issues combine to create a perfect storm – a climate ripe for hackers to take advantage of. (Lord, 2017) Below are the trending data loss trends to watch out for: