The TJX Companies Inc. last week disclosed a wide-ranging security breach involving credit and debit card data, providing fresh evidence that IT security remains fragile at some retailers despite attempts by credit card companies to get them to better protect their data.
Framingham, Mass.-based TJX said an “unauthorized intruder” gained access to its systems in mid-December and may have made off with the card data of customers in the U.S., Canada and Puerto Rico, as well as the U.K. and Ireland. The retailer didn’t disclose the number of shoppers that may have been affected by the breach, saying that the full extent of the data theft “is not yet known.”
TJX, which owns retail chains such as TJ Maxx, Marshalls and HomeGoods, has since hired both IBM and General Dynamics Corp. to help it evaluate the extent of the data compromises and implement unspecified security upgrades.
At least some of the stolen information appears to have been so-called Track 2 data taken from the magnetic stripes on the back of credit and debit cards, said Benson Bolling, assistant vice president of lending at the Alabama Credit Union in Tuscaloosa.
The credit union is recalling and replacing about 2,900 Visa debit and credit cards after having received multiple alerts last week from Visa U.S.A. Inc. about card information — including Track 2 data — being compromised in a retail breach. The alerts didn’t identify the retailer involved in the breach, Bolling said.
Track 2 data includes account numbers, expiration dates and encrypted personal identification numbers, plus other information that card-issuing banks can include at their discretion. Retailers are forbidden from storing such information under the Payment Card Industry (PCI) Data Security Standard being pushed by Visa, MasterCard International Inc. and other credit card companies. But many retailers continue to do so, often because their point-of-sale systems capture and store the data by default.
Further Protections
The breach at TJX shows why it’s so vital to purge the Track2 data from systems, said David Taylor, vice president of data security strategies at Protegrity Corp., a Stamford, Conn.-based company that offers PCI compliance services. It also underscores the importance of encrypting sensitive data, another step that the PCI standard requires, Taylor said.
The latest incident is sure to lend even more urgency to efforts to get retailers to adopt the PCI requirements, said Avivah Litan, an analyst at Gartner Inc. Litan said that thus far, only about 50% of Tier 1 merchants — those processing more than 6 million credit card transactions per month — have become fully compliant with PCI, which went into effect 18 months ago.
TJX is a Tier 1 merchant and may even qualify as a card processor because of the sheer number of transactions it handles through its various retail chains, Litan said. That would require it to adhere to even more stringent security requirements, she said, adding that she expects credit card companies “to come down really hard” on TJX.
Breach Reaction | |
|
At the same time, banks that issue cards should be looking at ways to make card information less valuable to thieves, Litan said. For example, stronger forms of authentication could be used when transactions are being processed, she said. Another possible approach would be to require one-time passwords when credit and debit cards are used.
The technology needed to support both of those steps is available and can be implemented fairly easily, according to Litan. But few banks appear to be doing so, she added.
The case for adopting such measures is strengthened by the fact that fraudsters are able to distribute stolen card information and make use of the data quickly, Litan and other analysts said.
According to John Buzzard, a fraud investigator at Fair Isaac Corp. in Minneapolis, information stolen in data breaches is sometimes used within 24 hours. Typically, data thieves do a quick “dump check” to see if stolen card numbers are valid and then either sell them for up to $25 apiece or use them to make one or two significant purchases or cash withdrawals, Buzzard said.
To reduce such fraud, he said, card issuers should establish measures for verifying that names, card numbers, expiration dates and other data match the information on record when transactions are being processed. Buzzard said he thinks “a large percentage” of card issuers are doing that kind of authentication already — but not all of them.
Stronger end-to-end authentication of credit and debit transactions by issuing banks could reduce the risk of card fraud, Taylor said. “But one of the things that is worth emphasizing,” he added, “is that the customer data belongs to the merchants and they need to take responsibility for it.”
Ben Cammarata, TJX’s chairman and acting CEO, said in a letter to customers that company officials were “extremely disappointed” when the intrusion was discovered. He added that TJX has brought in IBM and General Dynamics “to help us strengthen the security of our systems in order to prevent this from happening again.”
Related Articles and Opinion
- TJX data breach: At 45.6M cards, it's the biggest ever
- Stolen TJX data used in Florida crime spree
- Data breach at TJX leads to fraudulent card use
- Update: Retail breach may have exposed card data in four countries
- Martin McKeay: Guess what, the TJX compromise was bigger than initially revealed
- Robert L. Mitchell: Your credit card data may have been compromised. But don't worry.