The Biggest Risk Of Data Theft Lies Within A Company 's Customers

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

The Target Corporation has undergone many changes due to the 2013 security breach where hackers stole personal information from credit and debit cards of at least 70 million customers. Target sales and reputation has dropped from this instance, thus eliciting changes in their security systems, changes in management, and a few policy changes in handling customer information. With the public eye on the corporation’s handling of the situation, Target has been communicating these changes through various means. The changes they needed to communicate were informing customers of the security breach, addressing the bad press coverage to shareholders, downsizing of employees, and

This paper explores seven references that report the results from research conducted on-line regarding the 2013 Target breach. According to the website “Timeline of Target 's Data Breach And Aftermath: How Cybertheft Snowballed For The Giant Retailer” (2015), the breach occurred November and December 2013 in which customers who shopped at Target locations credit and debit cards were breached and their personal information was exposed. Upon their investigation, it was determined their point of sale system was hacked. “Wikipedia” states point of sale system which is used by third party vendors has cash registers as well as barcodes which stores customer’s information. The website “What is Packet Sniffer” (2016), Packet Sniffing may have been a way the attacked happened. “RAM Scraping Attack” website indicates what RAM means and how this type of attack happens. “What is a Firewall in Networking and How They Protect Your Computers” (2014), “What is Endpoint Security? Data Protection 101” and “Why SSL? The Purpose of using SSL Certificates” websites each provide ways to reduce and/or prevent future attacks.

On April 27, 2014 Michael’s CEO Chuck Rubin reported that criminals used highly sophisticated malware to infect some of the point-of-sale (POS) systems resulting in the theft of card related information including payments numbers & expiration dates (Michaels, 2014). The term POS system is used to describe the technology used by consumers to provide their payment information in exchange for a good or service. The primary stakeholders for today’s POS systems are consumers, merchants, acquirer, card brand companies,

Jarvis, K., & Milletary, J. (2014, January 24). Inside a targeted point-of-sale data breach. Retrieved from http://krebsonsecurity.com/wp-content/uploads/2014/01/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

In December 2013, Target was attacked by a cyber-attack due to a data breach. Target is a widely known retailer that has millions of consumers flocking every day to the retailer to partake in the stores wonders. The Target Data Breach is now known as the largest data breach/attack surpassing the TJX data breach in 2007. “The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised.” (Timberg, Yang, & Tsukayama, 2013) The data breach occurred to Target was a strong swift kick to the guts to not only the retailer/corporation, but to employees and consumers. The December 2013 data breach, exposed Target in a way that many

When online commerce first emerged, many consumers were wary of supplying their credit cards and giving their personal information to online stores. This led to the development of websites such as Paypal, which restricts the access a retailer has to one’s credit card number (Einstein). The threat of fraud has always been a worry for online consumers, but consumers face the same threats when shopping in a brick and mortar store (Chadwick).

Therefore, it provided to its customers a free offer to monitor their credit cards to prevent Identity Theft. But this service was not meaningful because it did not provide full monitoring. This is because the identity protection program gave the customers ability to check their balance if someone tried to buy something or use their card but would not prevent using it, what can be done is to call the banker as soon as to take necessary measures to stop that transaction. Accordingly, having a new program in the company was a big change and this change needed to be trained many of the staff and this was a big challenge to keep up with the program and the needs of customers to restore confidence and raise the company again. Also it presented a discount by 10 % during the weekend (Saturday and Sunday). Then the chief executive officer Gregg Steinhafel declared that the problem was solved and everyone could shop from Target without mentioning how the problem had been tackled or how to make sure that customers’ accounts would not hacked again. Furthermore, this problem solved by removed the files and malware from its

The TJX companies breach has been labeled the largest data breach in the history of security breach and the ultimate wake up call for corporations (Dash, 2007). TJX is the parent company of chains such as TJ Maxx, Marshalls, Homegoods, and a host of retail stores across the US and Canada. In January 2007, it was discovered that hackers stole as many as 200 million customer records due to a failed security system by TJX which resulted in a $4.8 billion dollars’ worth of damages (Swann, 2007). It is said that the breach occurred because they did not have any security measures in place to protect consumer’s data such as their debit cards, credit cards, checking account information, and driver’s license numbers. Reports identified three major

Cyber criminals continue to discover new ways to access a person's identity. This is true not only for their credit cards and bank accounts, but also for ID cards used at work. This tends to be of great concern to businesses, as they don't wish to share proprietary

The National Retail Security Survey reports that the average shrinkage rates in 2014 decreased or remained flat for more than six out of ten retailers (Hollinger et al., 2015). This demonstrates progress in implementing anti-theft measures, training, and internal processes because retailers continued to combat this problem with more advanced

The less sophisticated thieves have perfected the art of “dumpster-driving” rummaging through trash. Abusing employer’s authorized access to credit reports or some even playing ‘landlord’ has given them unauthorized access to victim’s reports. Some victims have been scammed fro information by an identity thief posing as a legitimate businessperson or government official. In the most recent news from Concord, NC (Aug. 19, 2004), the police have uncovered a more sophisticated case of ID theft. The newspapers stated, “Authorities think a portable credit card reader, or skimmer, was used to read personal information off a credit card’s magnetic strip. Then those details were applied to the strip on the back of a different cared.”

All the consumers affected were also made vulnerable to subsequent identity theft given malicious attackers stole their personal data. Equifax was directly affected since its stock began to plunge immediately the news was made public. Additionally, the corporate governance of the company was tarnished given three Equifax executives sold shares worth around $2 million days after the breach discovery, and the “retiring” of the chief security information officers is questionable (Surane & Melin, 2017). Also, the company was exposed to litigations with some lobbyists and interest groups pushing regulators to hold Equifax accountable for the negligence and poor treatment of affected consumers. The proposed new data security laws will present a greater burden to other corporations. Two such laws are the Promoting Responsible Oversight of Transactions and Examinations of Credit Technology (PROTECT), and Freedom From Equifax Exploitation (FREE) will attract more government scrutiny and limit the type of personal data that companies can collect from customers (Alperan, Carter, & Sofio, 2017).

Given the lack of ability to inspect merchandise before purchase, consumers are at higher risk of fraud than face-to-face transactions. Merchants also risk fraudulent purchases using stolen credit cards or fraudulent repudiation of the online purchase. However, merchants face less risk from physical theft by using a warehouse instead of a retail storefront. Secure Sockets Layer (SSL) encryption has generally solved the problem of credit card numbers being intercepted in transit between the consumer and the merchant. However, one must still trust the merchant and employees not to use the credit card information subsequently for their own purchases, and not to pass the information to others. Also, hackers might break into a merchant's web site and steal names, addresses and credit card numbers, although the Payment Card