Feeds

Banks lob sueball at Trustwave, Target over breach

'Round-the-clock monitoring' spun out, missed vulnerabilities

Designing a Defense for Mobile Applications

A group of banks has filed a class action lawsuit against Target over its recent data breach, and has named security company Trustwave as a co-defendant.

The late-2013 security breach resulted in at least 40 million customers' credit cards being compromised, after a Maryland contractor's systems provided a bridge into the retail giant's systems.

Trustwave is being targeted because, according to the banks, vulnerabilities in Target's systems remained “either undetected or ignored” in audits as recently as September 2013. These vulnerabilities included the fact that Target stored “credit and debit card data on its servers for six full days before hackers transmitted the data to a separate webserver outside of Target's network”.

Moreover, the filing claims, the Target breach went undetected for three weeks, even though the company “provided round-the-clock monitoring services to Target”.

It's against Target, however, that the most serious allegations are levelled. The class action led by Trustmark National Bank and Green Bank, say the retailer should not have allowed an outside contractor the access to its network that brought about the breach, and that it violated federal and state laws in storing the credit card data on its network.

Moreover, the lawsuit notes, repeated warnings and breaches stretching back to 2007 should have left Target in no doubt that vulnerabilities existed.

The suit cites America's Consumer Banking Association as estimating that the direct costs to banks have already reached $US172 million in re-issuing cards alone, with perhaps $US1 billion in the longer-term costs of fraudulent transactions resulting from the breach. ®

Application security programs and practises

More from The Register

next story
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.