TJX Data Breach Analysis

A root-cause analysis of the security breach revealed multi-factorial issues at the technical, individual, group, and organizational levels. At the technical level, the applications and web-tools

The purpose of this meeting is to inform you of a security breach that occurred in our company, and to inform you of what has been affected, how we found out, and what measures have been used to correct and prevent this from happening again. The following is a bulleted list of relevant information related to the security breach.

What do Premara Blue Cross, Anthem, Chick-fil-A, Sony, USPS, MCX, Staples, Kmart, Dairy Queen, SuperValue, Jimmie John's, Viator, Home Depot, PF Chang's, Community Health Systems, and JP Morgan all have in common? Each of these companies were hacked during 2014-2015. Sadly, this is just a short list showing the breadth of industries and size of operations that are vulnerable. According to Time Magazine in March, 2015, "You're not just imagining it: Lately, a new data breach has been reported almost every week."

On December 18, 2013, one of the security bloggers, Brian Krebs, posted in his blog that Target, one of the biggest US retailers, had suffered a massive data breach. The next day, Target announced that data from more than 40 million credit and debit card accounts had been stolen from its systems, and noting that they started a thorough investigation. Perhaps learning from Target’s mistakes, other organizations could achieve a goal of better protecting themselves and their customers’ information.

During the dates of November 27 through December 2013, the department store Target experienced a data breach in which approximately 40 million customers credit and debit cards were exposed. During this breach, customer’s personal information may have also been exposed for use of possible fraud. January

Statistics show that most security breaches are direct results of insider misconduct rather than being hacked. According to the most recent Verizon Data Breach Investigations Report, about “285 million records were compromised in 2008.” Seventy-four percent of the incidents were from inside sources. Users are more likely to be victims of computer virus infections, inquisitive students/co-workers, and hardware failures than to be victims of an Internet security attack.

In December 2013, the CEO, Gregg Steinhafle, of Target announced that their company was affected by a data breach that occurred between November 27 and December 15, 2013. “Target disclosed that online thieves hacked into its computer system, stealing credit card or personal information from more than 100 million customers. Both personal data and credit card information may have been stolen from about 12 million people” (Abrams, 2014). The outcome of this breach has cost Gregg Steinhafle his job, as well as the trust of Target’s consumers, investors, and close to $150 million in breach-related costs. This breach is considered one of the largest retail data breaches in U.S. history due to the amount of personal data and credit card

Pat Regnier and Suzanne Woolley in their article, “Thank You for Calling Equifax. Your Business Is Not Important to Us” discuss the issue of the Equifax data breach that happened earlier this summer. Regnier and Woolley provide details that the data breach may have released the information of 143 million people in the U.S. and that Equifax knew about the possibility of this data breach since March when it was made known that there was a flaw in the software.

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

Target has not disclosed much detail around the breach due to liability and legal issues but some information is available due to a leaked internal corporate report. The report included information by Verizon which was hired by Target to probe its networks for weaknesses days after the breach was

In December 2013, Target was attacked by a cyber-attack due to a data breach. Target is a widely known retailer that has millions of consumers flocking every day to the retailer to partake in the stores wonders. The Target Data Breach is now known as the largest data breach/attack surpassing the TJX data breach in 2007. “The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised.” (Timberg, Yang, & Tsukayama, 2013) The data breach occurred to Target was a strong swift kick to the guts to not only the retailer/corporation, but to employees and consumers. The December 2013 data breach, exposed Target in a way that many

Technology: it is obvious that TJX had several technology deficiencies mainly driven by systems limitations and vulnerability. For example, inadequate wireless network security allowed the hackers to attack specific stores just by using a laptop and an antenna which permitted the thieves access to the central database. As it was mentioned in the business case, TJX was using (WEP) as the security protocol and it is

All the consumers affected were also made vulnerable to subsequent identity theft given malicious attackers stole their personal data. Equifax was directly affected since its stock began to plunge immediately the news was made public. Additionally, the corporate governance of the company was tarnished given three Equifax executives sold shares worth around $2 million days after the breach discovery, and the “retiring” of the chief security information officers is questionable (Surane & Melin, 2017). Also, the company was exposed to litigations with some lobbyists and interest groups pushing regulators to hold Equifax accountable for the negligence and poor treatment of affected consumers. The proposed new data security laws will present a greater burden to other corporations. Two such laws are the Promoting Responsible Oversight of Transactions and Examinations of Credit Technology (PROTECT), and Freedom From Equifax Exploitation (FREE) will attract more government scrutiny and limit the type of personal data that companies can collect from customers (Alperan, Carter, & Sofio, 2017).

In January of 2007 the parent company of TJMaxx and Marshalls known as TJX reported an IT security breach. The intrusion involved the portion of its network that handles credit card, debit card, check, and merchandise return functions. Facts slowly began to emerge that roughly 94 million customers’ credit card numbers were stolen from TJMaxx and Marshalls throughout 2006. It was believed that hackers sat in the parking lots and infiltrated TJX using their wireless network.

Data breaches happen daily, in too many places at once to keep count. But there is some huge breach versus a small one and we will take some examples from the biggest or most significant breaches of the 21st century to show how much risk or damage the breach caused for companies, insurers and users or account holders.