Evan Schuman's StorefrontBacktalk

When federal officials unveiled on Tuesday (Aug. 5) indictments against 11 global cyber thieves accused of data raids against TJX and several other major retail chains, the retail chain that was potentially the most pivotal in ending the multi-national bits-and-bytes bonanza was kept out of the filings.

The feds were certainly not shy about naming retail victims in the 41 million payment card heist, listing in one of the indictments TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, DSW and Forever 21–at least one of whom might not have even known that they had been victimized until the Secret Service called. (See columnist David Taylor wondering how a retailer could be hacked and not know it.)

But the mystery retailer had several differences from the other retailers. First, this retailer was the only one whose perimeter security systems detected the mouse-toting bandits, although it did so only after the binary bullies had grabbed some card numbers.

Therein may lie the reason for this retailer’s mask. This Fortune 500 merchant is an unsung hero in breaking this case. Not coincidentally, that chain was the final one the defendants wirelessly hacked into through a Florida wireless access point. Blocked of their last system in mid-October 2007, one of the two men charged with attempting that final cyber thievery today faces life in prison, if convicted of all charges.

But the indictment casually mentions a potentially very serious fact. The group was charged with possessing customers’ track 2 debit card data—among other things. In theory, that shouldn’t have permitted ATM cash access because of the typical debit card key management technique known as DUKPT (Derived Unique Key Per Transaction).

DUKPT takes the PIN encryption processing away from payment devices, leveraging a derived key that is securely injected by a trusted third party. That approach was believed to be uncrackable. The defendants in this case discovered otherwise, as the indictment speaks of an associate of the defendants being asked to decrypt the encrypted PINs. Given that the indictment later references hundreds of thousands of dollars taken from ATMs by the defendants, it seems that the decryption efforts were successful.

This brings us back to our mystery retailer. Although that chain’s security was quite good—indeed, it was the only one that ever caught these penetrations—it apparently was in the middle of upgrading POS systems.

According to a source with knowledge of the chain’s operations—who suggested that both her name and the chain’s name be kept secret for now—the crooks caught them in mid-upgrade. The chain "has a huge installed base of legacy systems. The older the equipment, the more difficult it is to secure," she said. As for wireless, "When (the chain) started their push to strengthen Wi-Fi security, it took them a long time to get the old stuff all identified and cleaned out," she said.

Asked to explain why the chain was being kept secret, the source referred to the chain’s POS units and asked, "What if half of your cash registers don’t have Triple DES yet? You wouldn’t want people to know that" especially given that the chain’s upgrade plans don’t have the final units upgraded until 2010.

Michael Sullivan, the U.S. Attorney for Massachusetts, confirmed that the mystery retailer was involved in that final mid-October 2007 heist attempt.

"That retailer was not identified, if I remember correctly. We do have some reasons for not revealing that one, but I’m not prepared to explain the reasons for it," Sullivan said. "I don’t want consumers to be concerned or alarmed, but with that particular retailer, the breach was not nearly as successful as the others. It was successfully stopped, so that only a few numbers actually were taken before the security system shut them off. I think there were some concerns in terms of identifying the other retailer, and there could be a number of reasons for that. It wasn’t because someone asked if they could be kept out."