Evan Schuman's StorefrontBacktalk

One answer: Nothing—in fact, TJX has been doing E-Commerce since 2009 in Europe. A different view: TJX really doesn't want to be the next Target.com.Read more...

Gonzalez doesn't allege that any government employee ever asked—or authorized—him to do any of the break-ins for which he pled guilty. His position is more generic, that he needed to do these types of break-ins to maintain his skills so he would be of continued use to the government. In other words, he broke into those retail networks because he's a patriot.Read more...

You have to wonder who is left among the U.S. entities that have not sued—and then settled with—TJX for its infamous data breach of more than 100 million card numbers. The latest to come up to the till: The Louisiana Municipal Police Employees’ Retirement System. But the settlement here—for $595,000—is not the interesting bit. Part of the deal was a change in an IT boss. The settlement specified that IT security efforts need someone to oversee operations. What was agreed? That the job be given to TJX’s own audit committee. The TJX board’s audit committee shall, through Dec. 31, 2015, “oversee security of [TJX’s] computer system with respect to customer data, including [PCI] compliance,” the settlement said.

If you ever needed any proof of the strength of TJX’s legal position in these cases, you need look no further. When seeking an independent overseer, the best the plaintiffs could come up with was a committee within TJX’s own board? Setting aside the lack of independent perspective, this approach isn’t even a concession, given that the TJX board oversees such matters anyway. Want to freak out TJX investors? Tell them to imagine what this breach’s after-effects would have been had the attackers hit mobile transactions tied to debit cards. Were it not for zero-liability credit card programs, this legal outcome would be stunningly different. …

TJX has for years been the Poster Child for retail data breach. And to date, it is also the best example of how little material impact these breaches have. Read more...

Much of this defense sentencing recommendation tries to argue down how many dollars Gonzalez' activities have lost. Federal sentencing guidelines force judges to factor in how much damage the defendant's actions have caused and use that to help calculate the length of the sentence. It starts by suggesting that TJX weathered the cyberattack remarkably well. "The government has (produced) no evidence regarding the extent to which the stolen TJX data was ever used to an individual cardholder's detriment, as opposed to simply remaining on the server," wrote Gonzalez defense attorney Martin Weinberg. "And, as to TJX, a telling (indicator) of the degree of damage it suffered is found in the fact that during one of the most devastating economic periods in the country's history, TJX's stock value rose 30 percent."Read more...

Last Wednesday (Sept. 2), TJX struck quite a bargain and settled with the handful of remaining banks. In settling all charges with four different financial institutions—AmeriFirst Bank, HarborOne Credit Union, SELCO Community Credit Union and Trustco Bank—TJX agreed to pay $525,000 to be split between the four businesses. Was that punitive or was that something closer to a nuisance payment for the $19 billion retail chain? Punitive would generally mean covering all legal costs plus reimbursing the banks for all out-of-pocket costs and then paying them something to compensate them for the pain of the litigation. The payment specifically excluded legal fees. According to the statement TJX issued, the settlement didn't even cover all of the banks' out-of-pocket expenses let alone offer anything for their efforts. Oh and it also allowed TJX to say that it "has denied all wrongdoing." The amount enough that it was already covered in a reserve that TJX took back in the second fiscal quarter of 2007.Read more...

The deal (see our full coverage of the terms of the settlement) consisted of three elements: Payment; new security rules; the need to report back to the states. How painful were any of those elements for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners? Let's take a look at each.

But the dollars behind the settlement are relatively trivial for the $19 billion owner of Marshalls, T.J. Maxx, HomeGoods, A.J. Wright, HomeSense and Winners. The biggest impact will likely come from a wide range of security concessions, although many of the rules had already been directly or indirectly required by existing PCI guidelines.Read more...

It is true that discovery can be frightening for typical companies involved in class-action civil lawsuits, but for TJX, it can be positively terrifying. Throughout two trials, TJX showed itself to be far more worried about revealing thus-far-unreleased security details than monetary payments or almost anything else.Read more...

United States Court of Appeals
For the First Circuit
Nos. 07-2828, 08-1075, 08-1076 IN RE: TJX COMPANIES RETAIL SECURITY BREACH LITIGATION.
AMERIFIRST BANK and SELCO COMMUNITY CREDIT UNION, Plaintiffs, Appellees/Cross-Appellants, v. TJX COMPANIES, INC., FIFTH THIRD BANK and FIFTH THIRD BANCORP, Defendants, Appellants/Cross-Appellees.
APPEALS FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS [Hon. William G. Young, U.S. District Judge]
Before Boudin, Lipez and Howard,Circuit Judges.
Douglas H. Meal with whom Richard D. Batchelder, Jr. and Ropes& Gray LLP were on brief for TJX Companies, Inc.
W. Breck Weigel with whom Robert N. Webner, Vorys, Sater,Seymour and Pease LLP, James R. Carroll, Nicholas I. Leitzes andSkadden, Arps, Slate, Meagher & Flom LLP were on brief for FifthThird Bank and Fifth Third Bancorp.
Joe R. Whatley, Jr. with whom Patrick J. Sheehan, WhatleyDrake & Kallas, LLC, Archie C. Lamb, Jr., F. Inge Johnstone and TheLamb Firm, LLC were on brief for AmeriFirst Bank and SELCOCommunity Credit Union.
March 30, 2009
BOUDIN, Circuit Judge. Before us are cross-appeals stemming from a well known incident: the theft from TJX computers of customer credit and debit card information and the subsequent fraudulent use of the information. See generally In re TJX Cos. Retail Sec. Breach Litig., 493 F. Supp. 2d 1382 (D. Mass. 2007); McMorris v. TJX, 493 F. Supp. 2d 158 (D. Mass. 2007). Law suits ensued, this case–involving banks injured in the debacle–among them.
In January 2007, TJX Companies, Inc. (“TJX”), headquartered in Massachusetts and a major operator of discount stores, revealed that its computer systems had been hacked. Credit or debit card data for millions of its customers had been stolen. Harm resulted not only to customers but, it appears, also to banks that had issued the cards (“issuing banks”), which were forced to reimburse customers …

According to TJX's earnings statement issued Wednesday (Feb. 25), the chain had set aside significantly more money than it ended up needing to deal with the 2006 breach, thereby allowing the company to reallocate cash for other purposes and add about $18 million to the year's net income.Read more...

A key suspect in the TJX data breach case has been sentenced to 30 years in prison, but it has nothing whatsoever to do with the TJX case.

Maksym Yastremskiy was charged in Turkey with breaking into Turkish bank accounts electronically. During the hearing where he was sentenced to 30 years, he said that a laptop computer found in his hotel room containing bank information belonged to a friend. “I am innocent. I didn’t do anything to break bank accounts. Somebody else did it, not me. I want to be released from the jail,” he told the judge, according to The Boston Globe.…

Federal prosecutors have apparently accused a New York man of providing a sniffer program to help the TJX cyberthieves steal payment data. The fact that 25-year-old Stephen Watt has been charged with unlawful access to computers, wire fraud, aggravated identity theft and money laundering is not in dispute, nor is the fact that he has been accused of delivering a sniffer program to accused TJX mastermind Albert Gonzalez.

But the feds have been vague about whether Watt was involved in the TJX data heist, even though the timing of the accusations would seem to place him in the middle of the largest payment card data breach ever, according to this Computerworld story. Watt allegedly provided a sniffer program that allowed Gonzalez and other gang members to identify and capture credit and debit card data traveling over the networks they had broken into. In January, Watt edited and modified a sniffer program dubbed “blabla” that was used by the gang and stored in a server with a Latvian IP address, according to the story.…

A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.

The accused, Christopher Scott, a 25-year-old Miami resident, pleaded guilty after prosecutors said they could prove that he was paid $400,000 for assisting a retail wardriving scheme. Scott’s plea follows the Sept. 11 guilty plea of fellow Miami resident Damon Patrick Toey.…

In a filing on Thursday, U.S. Attorney Michael Sullivan told U.S. District Court Judge William G. Young that "There is forensic and/or testimonial evidence that the defendant and his co-conspirators hacked into numerous other businesses, which have not yet been publicly identified." Read more...

Campbell also backed encrypting data as it is sent to banks, even over private networks. There's little question that both moves would improve security, but the cost and change required will also make them almost impossible to deploy. As TJX execs know better than anyone, market forces to push such change are essentially non-existent. Read more...

TrustCo, which operates more than 100 banks nationwide, filed the lawsuit in the New York Supreme Court against TJX in July, saying that it had never been invited to participate in the initial group of banks suing TJX. This bank's accusations mirror the other banks' charges, namely that TJX "breached its duties" by allowing the intrusion. TJX replied that it was the bank's own fault.Read more...

One of those retailers—Barnes & Noble—issued a vague statement suggesting that the chain might not have been aware of the incident before the Secret Service team started making those 11:30 AM calls.Read more...

But now, the security of the accused thieves' data loot is the least of their problems. Indictments and informations released Tuesday (Aug. 5) charge the 11 conspirators with stealing 41 million credit and debit card numbers from major retailers including TJX.Read more...

The employee has been dubbed a whistleblower and it's been suggested that TJX was wrong to have terminated the guy. In this case, I have to stand up for TJX: They were completely within their rights to terminate this employee. As for the charges themselves, those are dramatically more troubling. Read more...

When TJX announced a MasterCard agreement last month to pay $24 million for data breach costs stemming from the industry’s worst payment card data breach, it was contingent on at least 90 percent of the banks agreeing.

No surprise, but TJX made that acceptance rate with room to spare, coming in at 99.5 percent, the retailer announced May 14. …

TJX will pay as much as $24 million to cover databreach losses suffered by MasterCard banks, assuming 90 percent of the banks agree to the settlement offer, TJX and MasterCard announced on Wednesday. TJX last year announced the world’s worst payment data breach, which impacted some 100 million cards.

Participants “must agree not to seek or participate in any other recoveries that may be available to issuers and must also release MasterCard, TJX and TJX’s acquirers from all legal and financial liability associated with the TJX data breach, ” a joint statement said. Those banks have 30 days to whether to accept the offer. …

That report also found that TJX "did not require network administrators and other users to use strong passwords or to use different passwords to access different programs, computers, and networks" and that it failed to "use readily available security measures to limit access" and cited one crucial example: not "using a firewall to isolate card authorization computers."Read more...

Referring to $178 million the chain had set aside to deal with data-breach-related costs, TJX said that on Jan. 26, 2008, "TJX reduced the reserve by $19 million, primarily due to insurance proceeds with respect to the computer intrusion, which had not previously been reflected in the reserve, as well as a reduction in estimated legal and other fees as the Company has continued to resolve outstanding disputes, litigation and investigations." Read more...