Evan Schuman's StorefrontBacktalk

Only TJX could take a lawsuit settlement from the worst retail data breach ever and try and turn it into an upsell situation.

TJX's multi-part settlement of all of the consumer lawsuits against it for its massive data breach is a fascinating denouement to the TJX saga. What makes this latest twist so delicious is that TJX has played this debacle the way a retailer should, assuming the retailer is Niccolo Machiavelli.

When admitting to a massive databreach impacting some 46 million of your customers and when also conceding by implication that much of it was your fault given inadequate security measures, most companies would be chagrined, embarrassed and perhaps even a little bit ashamed. But not our heros.

Initial indications suggest that Oracle’s $25 billion retail app buying spree may have been quite shrewd, according to this Bloomberg story.

The story painted a picture of a move that at the time seemed quite risky. Risky, that is, to anyone who didn’t work in retail. “With margins as thin as 1 percent, retailers were among the most conservative software buyers, typically purchasing the cheapest programs and using them for as long as possible,” the story said. “Department store owners and other retailers changed as supply and inventory management became more complex, merchants offered goods from more overseas companies and Internet sales expanded.”…

There are some errors that are too delicious to not share and also too wonderful to even need any sarcastic comments. (This is said by someone who believes that one should never be stingy with sarcasm.)

It seems that TJX, in an SEC filing this week, dubbed themselves “in bold capital letters at the top of the filing: The Perfect Company,” according to this Boston Globe story with one of my favorite headlines ever.(“TJX Cos. to SEC: Perfect We Are Not”)

Said TJX senior excuse maker Sherry Lang: “The leading financial services vendor who handled the filing of this form has admitted that the error occurred at its facility and they are looking into it. A corrected Form 8K will be filed shortly.”…

With Borders just seven months away from having to fly on its own without Amazon.com, the nation's second-largest bookseller has quietly launched its beta site. When Borders announced in March that it was ending its agreement with Amazon—where Borders all-but-surrendered its online presence to Amazon—it's executives outlined an unusually aggressive plan to turn its stores into models of merged-channel strategy.

In the preliminary beta site triggered live on Sept. 6, only the most faint hints of that strategy is evident. The layout/design is intended to visually reinforce the chain's roots. "The site now feels like a bookstore," said Kevin Ertell, VP of E-Business at Borders.

One of the Miami residents charged with trying to sell stolen TJX credit card data has been sentenced to five years in prison and ordered to pay $600,000 in restitution, the Florida state Attorney General announced Thursday.

Irving Escobar and several others were charged with using counterfeit credit cards that they manufactured using the stolen data from the TJX breach. "Authorities believe Escobar and his codefendants acquired the stolen data and used it to re-code the counterfeit credit cards which were then used to purchase the gift cards," according to a statement from the AG's office.

McDonalds is experimenting with the ultimate line-buster in South Korea, where customers purchase food on their cellphones, which then ring when the order is ready.

But this trial is much more an RFID effort than a traditional mobile experiment. Most of the phone's communications capabilities and its display are barely used, with customers having to download a McDonalds application into their phone.

Sometimes, it’s good to be the king, even if it’s the king of online search. Google’s founders have landed a great new parking space for Boeing 767-200: an airport run by NASA that is typically closed to private aircraft, according to this New York Times piece.

The deal is certainly unusual, but it’s not especially one-sided. While Google brass gets their nearby mammoth parking, they are paying $1.3 million a year plus NASA officials have “signed a unique agreement last month that allows it to place scientific instruments and researchers on planes used by the Google founders. NASA gets to collect scientific data on some flights of those jets, which in addition to the Boeing 767-200 includes two Gulfstream Vs,” the Times story reported.…

The implantable RFID chip story is getting more frightening, with the Associated Press now reporting a series of tests showing cancers being caused by the implants.

This is potentially significant as Applied Digital has been working aggressively to implant these chips as widely as possible. Although this isn’t likely to have a huge impact on traditional retail RFID efforts, any reliable reports of cancer-causing agents are going to raise questions. With tags being sewn into the layers of clothing, will the cancer reports become more widespread?…

In another unintended consequence example, contactless payment and mobile payment efforts seem to have stunted the growth of retail biometrics. Is this a marketing fault or the death of an idea that never had much of a chance?

A few years ago, retail biometrics had what seemed to be a very bright future. They promised superior security and a permanent CRM association. If that customer switched credit cards, moved to another state, changed their name and changed cellphone companies, the fingerprint would still allow all purchases to be associated with an individual customer.

Retailers of all sizes need to intensify their data security protections, but different kinds of threats merit different kinds of defenses.

With all of the PCI and data breach talk these days, it's easy for retailers of all sizes to be on edge. Although it's undeniable that merchants and all sizes need to protect themselves, different issues threaten Wal-Mart and Phil's Bait Shop.

Larger retailers can be seen as the better targets in the Willy Sutton School Of Thought (when asked why he robbed banks, the legendary holdup man is said to have replied, "That's where the money is"). But smaller merchants can be attractive for the opposite reason, namely that they are likely to have less sophisticated defenses. The term cyber thief today actually describes bad guys in three very distinct groups.

The Germany-based Metro Group, one of the world’s largest retailers and one of the strongest RFID advocates, has gone into fullscale RFID deployment. But the more interesting news is that Metro has decided to penalize suppliers who don’t properly comply.

“Some sort of levy will be imposed for each non-compliant — that is, untagged — pallet shipped by the supplier to the retailer,” said an RFID Update story. “Exactly what that levy will be is unclear. Industry hearsay puts it at two euros per untagged pallet, but METRO has not confirmed the figure.”

The story pointed out that this is in stark contrast to how Wal-Mart has been enforcing its supplier rules. Wal-Mart’s “RFID mandate was considered aggressive indeed but stopped short of threatening a financial penalty for non-compliance,” the story said.…

background-image: url(“/images/copy/AmazonLogo.jpg”); background-repeat: no-repeat’

In an SEC filing from Aug. 31, , Amazon.com reported that its CIO, Richard Dalzell, will retire by the end of this year.

Dalzell, through an Amazon spokesperson, declined an interview request. His official Amazon bio is unclear on how long he held the CIO title. But it appears that he has held the tech chief role since August 1997.

Before joining Amazon, he held some senior IT roles within Wal-Mart, giving Dalzell the distinction of having managed IT for the world’s largest online and brick-and-mortar brands.…

For e-tailers that use their in-store inventory also as their online inventory, they are discovering a problem with the supply-chain blackhole: which products invisibly enter when they leave the shelf and don't re-emerge until they are paid for.

This is particularly an issue with retailers trying to make shop-online-pickup-instore work. Without item-level tracking, the concept of a realtime inventory is almost impossible to deliver. This problem is only going to get worse during the holiday onslaught, especially when online purchasers are trying to get the hottest and most popular gift.

PCI deployment isn't perfect, but it's quite impressive how far it's come given the mammoth obstacles. As its most public face, Visa has taken a lot of the criticism, but it also deserves much of the credit.

As a group, humans are a tough audience. Cruelly and quixotically, the more difficult and massive the task, the quicker we are to point out the shortcomings rather than praise the accomplishments. Please don't get me wrong. There are plenty of issues with PCI deployment today. But let's not be too quick to attack the very good for not achieving the unattainable perfection.

When one Phoenix jean merchant wanted to boost his bottom line, he decided to not look back and to get positively cheeky. (My apology for that lede, but this story pretty much demands it.)

The Hub Clothing store, which sells high-end jeans for between $135 and $900, decided to use specially-placed video cameras to show customers what a traditional mirror couldn’t easily show: their bottom, according to this Associated Press story, which also features this wonderful video segment. The Buttcam–their name, so help me–sounds like a terrific idea, but hope it doesn’t backside on the merchant.…

The love-hate relationship that is the American retailer-bank-credit-card marriage is nothing if not complex. There are few partners that ignite such wrath and venom within retailers than their credit card partners and their—well, let's just say "generous"—interchange fees. On the flip side, the banks and credit card firms seeing themselves as having to pay the PCI piper whenever there's a data breach, even if—from the bank/card perspective—that breach was the fault of the reckless retailer.

But like so many business relationships, hatred can be trumped by only one thing: greed. Which is the most terrifying? The prospect that a retailer may no longer be able to accept major credit cards or that the banks and card companies will lose all of that revenue to alternative payment vendors?

For more than a year, Visa has ominously warned large retailers that it would enforce a strict Sept. 30, 2007, deadline for many of the nation's largest retailers to either be certified that they comply with industry credit card security requirements or face fines and being expelled from discounted credit card fee programs.

But as the deadline has gotten closer—and the percentage of retailers certified as compliant is still quite low--Visa has been forced to back off, albeit slightly. This month, Visa has been quietly floating memos that will soften the pain for non-compliant retailers, as it's become clear that non-compliants will have strength in numbers come early October.

When the $17 billion retailer reported that pre-tax $168 million possible hit for its data breach, did it see it as anything more than a cost of doing business? And a minor cost at that?

With all of the numbers that TJX issued in its Tuesday earnings statement, the one that has generated the most attention was a $168 million estimated hit associated with the data breach announced in January, which saw consumer information from an estimated 46 million debit and credit cards walk out the door.First, the optimistic side. TJX did not, in fact, say that it actually has spent—or necessarily will spend—anything more than a tiny fraction of those dollars. The overwhelmingly largest charge—a $107 million after-tax figure for the chain's second 2008 fiscal quarter—was merely a "reserve," a nestegg for what TJX fears its costs may be. Theoretically, its costs might be much lower.

New credit card security rules will require a wide range of companies working with audio files from retailers to protect credit card information. According to a memo being circulated within the PCI Security Standards Council, the new rule is aimed at protecting card validation codes and values "received by call centers on audio recordings."

The problem is not necessarily with call center employees that might use the data improperly—as they could access such data in quite a few easy ways—but with outsourced companies that review the tapes for customer service purposes.

In mid-September, London will launch its first large-scale contactless payment trial, with some 2,000 retailers slated to participate. Although Europe has more aggressively embraced various wireless technologies than the U.S., it has sharply lagged the U.S.—and certainly parts of Asia—with contactless payment.

"As in many major cities across Europe, millions of people across in London use contactless ticketing on public transport. However, when it comes to contactless payments, challenges remain with regard to business models and partnerships," said Jonathan Collins, an RFID senior analyst with ABI Research.

How did the TJX breach start? Reports that the attack began using a wireless entry point have been confirmed by multiple investigators, but reports that circulated in March that the attacks began via an in-store employment kiosk have re-emerged.

Could both be true? It’s unlikely, as both entry attempts were reprotedly successful, raising the question of why the second was attempted. Could TJX have actually been the victim of two simultaneous and unrelated attacks, one using wireless and the other a jobs kiosks that was not firewall-protected?

The latest kiosks reports have the terminals being opened and the bad guys using USB drives to load software. Read more.…

In the never-ending uphill battle to try and convince consumers that self-checkout systems are their friends, NCR has released a survey with a new twist: self-checkout can be less embarrassing.

In an NCR survey done with Australian and New Zealand consumers—it’s a bit of a distance away, but the details make it worth the trip—, various products were ranked according to their red-face-generating capabilities.

The winners were: “libido enhancing vitamins” (the winner with 44 percent of Austalians and 35 percent of New Zealanders), hemorrhoid cream (a respectable showing at 29 percent and 37 percent respectively), incontinence products (28 percent and 38 percent) and condoms (20 percent and 25 percent).…

In the ongoing saga of retailers being sued for not properly truncating consumer receipts, this week came word that Apple’s brick-and-mortars have now been added to the mysterious case of “Truncated Receipts Don’t Tell Tales.”

Apple’s bite of the forbidden receipt fruit comes from this Florida lawsuit filing.. The lawsuit is different from other FACTA lawsuits in that the plaintiffs were online shoppers and the receipts were electronic files E-mailed to the plaintiffs.…

With many trying to out-service and out-specialize Wal-Mart, grocery chains are looking to spend more than $9 billion over the next year, according to a new report from the IHL Consulting Group.

One of the big trouble spots that IHL saw for grocery chains is the lackluster performance of many loyalty programs, which IHL President Greg Buzek attributes to most retailers deploying the packages poorly. The programs are generally used more as discount programs ("come in with your card and you'll get discounts on 400 specially-marked items") than as an attempt to understand individual customer's buying habits and to make their experiences better, Buzek said.

In our Retail Week In Review audiocast for Aug. 8, our panel looked at: Consumer Reports story that U.S. consumers lost more than $7 billion over the two years to viruses, spyware and phishing schemes; the Black Hat conference and its demo of how easily cookies can be captured online and used to fake identification; and the security issues surrounding contactless payment, as MasterCard announced this week a sharp expansion of its PayPass contactless card program.

Panelists this week were: Mark Rasch, former head of the U.S. Justice Department’s high-tech crimes unit; Motorola’s Chris Hinsz, who is the newest member of the PCI Security Standards Council; and Dave Taylor, president of the PCI Security Vendor Alliance, whose dayjob is with Protegrity.

Site visitors can listen to the full 30-minute discussion or to panel introduction plus just the conversations about Online or Contactless Payment or Cookies.…