Inadequate security safeguards led to TJX breach, Commissioners say

[<rms () computerbytesman com>]

http://www.newswire.ca/en/releases/archive/September2007/25/c4626.html

Inadequate security safeguards led to TJX breach, Commissioners say 

    OTTAWA, Sept. 25 /CNW Telbec/ - The risk of a breach of sensitive

personal information held by TJX Companies Inc., the US parent company of

Winners and HomeSense stores in Canada, was foreseeable, but the company

failed to put in place adequate security safeguards, an investigation by the

Privacy Commissioners of Canada and Alberta has found.

    "The company collected too much personal information, kept it too long

and relied on weak encryption technology to protect it - putting the privacy

of millions of its customers at risk," says Privacy Commissioner of Canada

Jennifer Stoddart.

    "Criminal groups actively target credit card numbers and other personal

information," says Commissioner Stoddart. "A database of millions of credit

card numbers is a potential goldmine for fraudsters and it needs to be

protected with solid security measures.

    "The TJX breach is a dramatic example of how keeping large amounts of

sensitive information - particularly information that is not required for

business purposes - for a long time can be a serious liability."

 

.

 

    <<

    - TJX did not properly manage the risk of an intrusion against the
amount

      of customer data that it collected.

    - The company failed to act quickly in converting from a weak encryption

      standard to a stronger standard.  The conversion process took two
years

      to complete, during which time the breach occurred.

    - TJX did not meet its duty to monitor its computer systems vigorously.

      An adequate monitoring system should have alerted the company of an

      intrusion prior to December 2006.

    - The company did not adhere to the requirements of the Payment Card

      Industry Data Security Standard, which was developed to address the

      growing problem of credit card data theft.

    >>

 

 

 

 

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.