Feeds

TJX security breach fears grow

How deep does the rabbit-hole go?

3 Big data security analytics techniques

TJX, the US retailing giant,says a hacker intrusion against its credit card transaction processing system is more serious than first reported.

The breach, detected in December 2006, affected systems handling debit and credit card transactions as well as cheque purchases and refunds at the company's TJ Maxx, Marshalls, HomeGoods and A J Wright stores in the US and Puerto Rico; and its Winners and HomeSense stores in Canada.

Last month, TJX said the intrusion took place between May 2006 to January 2007. The firm now reckons attacks date back to July 2005 and involve transactions up to June 2004 - previously, it thought they were confined to 2003. It still maintains names and addresses were not included with the credit and debit card data reckoned to have been compromised. But It's beginning to look more likely that some of the chain's customers in the UK and Ireland, the retailer operates the popular clothing store TK Maxx, may have been put at risk. TJX’s investigators have found evidence of an intrusion to the portion of its computer system that processes T.K. Maxx customer transactions.

TJX now reckons a number of drivers' license numbers together with related names and addresses were also compromised. This data relates to receipted merchandise returns at its T.J. Maxx, Marshalls, and HomeGoods stores in the US and Puerto Rico for the last four months of 2003 and May and June 2004. TJX intends to write to customers in this category, warning that their details might have been exposed.

TJX has hired a team of 50 security consultants to investigate the breach. But the number of customer records that might have been exposed by the attack and the value of financial losses sustained as a result of the assault is still unknown. TJX has taken a $5m charge to cover the investigation, legal fees and costs associated with explaining the problem to its customers. But it has not made any contingencies for legal penalties or restitution that it could be foreced to make.

An update on TJX's investigation can be found in a press release here.

The update on the hacking investigation came on Wednesday as TJX announced its annual financial results. TJX's sales for the year were $17.4bn, a nine per cent increase over last year, with net income of $738,000. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.