Over 45 million card numbers gathered in massive breach.
A report into a security breach at major US retailer
TJX
has revealed a lengthy and sophisticated attack which scooped vast amounts of sensitive personal data on users of the company’s chains of clothing and home stores, believed to be the largest ever haul of information from a computer hack.
The
TJX
group, which includes the
T.J. Maxx
and
Marshalls
chains in the US and
T.K. Maxx
in the UK and Ireland, has issued its annual report, including lengthy analysis of the hacking incident first discovered in December last year and disclosed publicly in February. Although details remain shadowy, with little known of the attacker’s identity or methods, it appears that payment card detail for at least 45.7 million of the chain’s shoppers was taken in an 18-month period in which the hacker had considerable access to the company’s systems.
The intrusion was first spotted on December 18th 2006, and reported to authorities on December 22nd. Subsequent investigations discovered that the attacker may have first broken into
TJX
systems as early as July 2005, with data stored on servers in Framingham, Massachusets, and Watford in the UK, accessed and stolen. The full extent of the data theft may remain unknown, as much of the data may have been routinely deleted by the firm after it was gathered by the hacker, who also used advanced encryption to hide his traces and may have broken encryption systems used by
TJX
to store their data.
Many of the cards compromised by the attack, used for transactions at
TJX
‘s 2,500 cut-price stores from December 31st 2002 onward, have since expired, no PIN data is thought to have been gathered and no card information at all is believed to have been taken from the UK-based systems. However, large quantities of other sensitive data is also thought to have been taken, including the names and addresses, and possibly driving licence numbers, of as many as 450,000 people.
The incident has already cost the firm $5 million in expenses related to the investigation, cleanup and shoring up of security measures, with future costs including compensating potentially huge numbers of fraud victims impossible to estimate.
TJX
has vowed to continue its attempts to track down the hacker and to ensure the future security of its networks. The full report can be found (in PDF format)
here
(see pages 7-10).
Posted on 30 March 2007 by
Virus Bulletin
Leave a Reply