![Joe Vest, (CISSP, CISA, CEH) [email_address]](https://image.slidesharecdn.com/tjxattack-110204141956-phpapp01/85/TJX-Attack-14-320.jpg)
TJX Attack
- 1. 11-13-2007
- 2. Largest Known Credit Card Theft TJX Companies Marshall’s T.J. Maxx Home Goods A.J. Goods
- 3. What Happened? July 2005 Attackers gained access to the wireless network in a Marshall’s discount clothing store in Miami, FL. Over the next year, the internal network was systematically searched for valuable information. May 2006 Sniffer was installed on the network and over 80 GB of unencrypted data was sent to a site in California. December 2006 The incident was discovered by TJX and reported to law enforcement.
- 4. How was it done? The store was protected with WEP (Wired Equivalent Privacy) Weakness of WEP has been known since 2002 and replacements available in 2003. The ‘cracking’ of WEP is trivial. The key can be gained in a matter of minutes. Once inside, the attackers created backdoor accounts and could work from anywhere in the world.
- 5. What was stolen? Recent Estimates find more than 94 million credit cards exposed. 451,000 customers had a breach of personal records. Drivers license numbers Military ID numbers Social Security Numbers Much of the information contained Track 2 data. Track 2 data includes personal identification numbers and card verification codes and can be used to counterfeit payment cards.
- 6. Related Damages May 19, 2007 Six suspects were arrested for credit card fraud in Florida. The six were accused of purchasing gift cards with credit card numbers from the TJX incident. In total, over $8 million in credit card charges were made.
- 7. Related Damages August 21, 2007 Maksym Yastremskiy, 24, was arrested in the Turkish resort town of Kemer. He was tracked by U.S. Postal Inspection Service’s global investigations unit. He was trafficking more than 1 million credit card numbers. Numbers sold for $20 to $100.
- 8. Latest News Friday September 9, 2007 TJX announces settlement of numerous class-action lawsuits Settlement Terms: Each impacted customer would receive 2 $30 vouchers for TJX stores. Customers who returned merchandise (leaving behind their drivers license number) would have credit monitoring for 3 years with $20,000 in ID theft coverage Settlement pending ruling by judge
- 9. Latest News September 14, 2007 Irving Escobar sentenced to five years in prison and ordered to pay $600,000 restitution for his role in the gift card fraud in Florida. The Co-defendants all pled guilty and were sentenced to probation.
- 10. Latest News October 22, 2007 New lawsuit against TJX Filed on behalf of 300 banks in Massachusetts, Maine and Connecticut to reclaim damages due to credit card replacement Pending decision from judge to bring to class-action status.
- 11. Total Damages $68 million in Visa cards alone TJX lost $118 million in profits the 1 st quarter after the incident. Current estimates for TJX dealing with the incident are $256 million. It is estimated the total damages could exceed $1 Billion due to: Fraudulent credit card purchases Banks reissuing credit card Damage to personal credit.
- 12. What went wrong? No Defense in Depth WEP was used Attackers were able to get to the corporate databases through remote stores network. Customer data was stored for too long (Some credit cards were from transactions in 2003) Customer data was stored that should not have been PCI DSS standards not followed
- 13. What can be learned? Security must be incorporated in all aspects of business and risks must understood. Security is not a product you can buy. Security is a process that must constantly evolve. Do not store unnecessary information Don’t use WEP (thanks Josh)
- 14. Joe Vest, (CISSP, CISA, CEH) [email_address]
- 15. References http://www.privcom.gc.ca/cf-dc/2007/TJX_rep_070925_e.asp http://www.securityfocus.com/brief/465 http://www.securityfocus.com/brief/594 http://online.wsj.com/article/SB117824446226991797.html http://www.securityfocus.com/news/11493/2 http://blog.washingtonpost.com/securityfix/2007/10/tjx_breach_was_twice_as_bad_as_1.html