Citing new information about the TJX data breach, attorneys suing the clothing retail chain amended their complaints on Oct. 25 and want a jury to evaluate TJXs security professionalism.
New details that emerged from documents filed in federal court Oct. 25 include:
- A TJX consultant found that not only was TJX not PCI-compliant, but it had failed to comply with nine of the 12 applicable PCI requirements. Many were “high-level deficiencies,” the consultant said.
- “After locating the stored data on the TJX servers, the intruder used the TJX high-speed connection in Massachusetts to transfer this data to another site on the Internet” in California. More than “80 GBytes of stored data improperly retained by TJX were transferred in this manner. TJX did not detect this transfer.”
- In May 2006, a traffic capture/sniffer program was installed on the TJX network by the cyber-thieves, where it remained undetected for seven months, “capturing sensitive cardholder data as it was transmitted in the clear by TJX.”
- In 2004, before the attacks began, TJX was issued a report on its security compliance that “identified numerous serious deficiencies at TJX, including specific violations. TJX did not remedy many of these deficiencies.”
- At his deposition, the unnamed TJX consultant said that “he had never seen such a void of monitoring and capturing via logs activity at a Level One merchant as he saw at TJX.”
- “The data breach at TJX affected more than 100 million separate and distinct credit and debit card account numbers, more than twice the size of the next largest data breach in the history of the country.”
- The filings confirmed that both Visa and MasterCard have fined TJX. Visa issued “a substantial fine” in connection with the TJX data breach, dubbing it an “egregious violation” of security procedures. The sizes of the fines were not specified.
Click here to read more about why TJX wanted to keep its IT security details secret.
The filings for the first time also listed the key security problems that a TJX consultant found: improperly configuring its wireless network; not segmenting cardholder data devices from the rest of network traffic; “TJX did not have an IT department that was properly tasked to manage the environment used to store, process or transmit cardholder data”; improperly storing prohibited cardholder data; using usernames and passwords “that were easy to penetrate”; improper patch procedures; logs not properly maintained; anti-virus protection “improper”; and weak intrusion detection.
The size of the TJX data loss keeps growing. Read more here.
Oct. 25s revised complaint linked the bad security practices with the computer breach, which forced banks to take expensive actions to defend themselves. One key issue in civil cases such as this is whether the defendant can be shown to be simply careless or deliberately reckless. That distinction relies on showing what was likely in the defendants mind at the time of the acts that led to the data breach.
Attorneys for the banks indicated they would try to show that intent with internal TJX documents obtained during discovery. “TJX knew—and discussed internally prior to the breach—that its deficiencies in network and data security could lead to the exact losses incurred here in the many millions of dollars,” said the filing. “Had TJX properly disclosed information about the extent of its noncompliance with network security requirements prior to the breach, then actions to correct the deficiencies and prevent the breach could have been taken,” the filing said.
Retail Center Editor Evan Schuman can be reached at Evan.Schuman@ziffdavisenterprise.com.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.