Evan Schuman's StorefrontBacktalk

The data breach consisting of extensive cyber thief activity within TJX's network from 2003 through June 2004 and then again from mid-May 2006 through mid-December 2006, TJX said. Court filings have estimated that the data from some 96 million credit cards was accessed during the incidents. Read more...

In the NRF's second annual return fraud survey, the retail group asked 60 loss prevention execs in October what they guessed/projected would be their fraud this holiday season. Please note they have no basis to make such a prediction—given the lack of paperwork filed by the typical shoplifter and related fraudsters—other than to project off of last year's figures. Read more...

The Dec. 29, 2005, letter from Joseph Majka, a fraud control vice president for Visa, was written months after cyberthieves had already secretly infiltrated TJX's systems, starting the work that would ultimately become the worst data breach in credit card history.Read more...

Retail software sales last year were $7.3 billion, with a compound annual growth rate of 7 percent through 2011, "catapulting the market to $10.4 billion," the report said. Read more...

For years, American technology leaders have gotten used to seeing the U.S. no longer globally technologically dominant. But nowhere is that lack-of-dominance more pronounced than with cellphone technology. That's why I saw this week's Google Android news as something that was exciting in its potential to shake the industry up. Trust me: this is one sector that truly needs a lot of shaking up. Read more...

"There has been a lot of talk about social shopping," said Patti Freeman Evans, the report's lead analyst, but that talk hasn't translated into sales. "Social and community sites still rank low in shoppers' minds as useful places to research and shop for gifts. Only three percent of users who plan to buy online this holiday season—and six percent of those in the segment who are ages 18 to 34—plan to add a wish list or gift list to their MySpace, Facebook, or similar Web site page to help their friends and family select gifts." Read more...

"its payment processing assets are no longer part of the company's core business and are being considered for sale," the newsletter report said. Read more...

"As smartcards continue to penetrate applications such as contactless payment, ticketing, security/access control, and e-government, the need to simplify interactions by reducing the overall number of smartcards used by an individual will increase," the report said. Read more...

New court filings on Friday also made public E-mail exchanges involving the TJX CIO, which attorneys are using to show that the retail chain knew how weak its security was right before the breach and yet allowed it to continue. Read more...

New details that emerged from documents filed in federal court Thursday include that a TJX consultant found that not only was TJX not PCI-compliant, but that it had failed to comply with nine of the 12 applicable PCI requirements. Many were "high-level deficiencies," the consultant said. Read more...

But those details have typically hinted at or suggested a wide range of security problems. After months of motions and arguments, filings have begin for the argument that frightens TJX the most: whether U.S. District Court Judge William Young will order that TJX reveal publicly exactly how it believes the breaches occurred and why they happened.Read more...

Although the numbers do show a sharp increase, they also reflect the fact that 35 percent—more than one out of every three—large retailers today are still not PCI compliant, despite the passing of the Sept. 30 deadline and the start of the promised $25,000/month fines for non-compliance.Read more...

The problem of retailers relying too much on technology and cutting off customer feedback is only half the problem. Customer service outsource companies are finding it quite easy now to interpret policies however they want and to then hide unhappy customers from their retail clients. Read more...

A consumer shopping for a home entertainment system accesses a 3-D CADCAM representation of his home and drags it to an entertainment E-Commerce site. This large digital file, however, is much more than a mere architectural depiction of the consumer's home.

It includes window placement and the times of day—during different months—that the sun shines through various windows and at roughly what intensity and for how long. Someone has entered the style of thickness of the rug and wall-coverings and a database lookup has associated those with their likely sound-dampening characteristics. Read more...

The new numbers came to light in filing from attorneys representing some of the banks now suing TJX. Read more...

As the legal arguments start to unfold—as they did this week in a Boston federal courtroom—there is little discussion yet about responsibility to protect cardholder data. Most of the TJX defenses seem to be variants of "Everybody was doing it, so why pick on me?" As the state trooper would reply on that New York highway, "Because you got caught." Read more...

Every day, we’re seeing a steady flow of hints that alternative payments are becoming a wee bit less …. well …. alternative.

This week, US Airways announced that it would start accepting PayPal for tickets. That news follows similar announcements from Northwest Airlines, Southwest Airlines and Midwest Air. Nothing shocking here, but airlines are hardly cutting-edge payment outfits. If they’re warming up to alternative payments, there may be something there.…

To be certain, MasterCard, AmericanExpress and others have been active in PCI circles, but they're been quite willing to let Visa take all of the public heartaches.

Is that now changing, albeit a little bit? When the National Retail Federation came out, asking that retailers no longer be required to retain credit card data after authorization, it was MasterCard—not Visa—that issued a statement and a stinging statement it was, saying the NRF plan was "inaccurate and unjustified."Read more...

Pathmark is rolling out a branded combination loyalty and payment card, selling convenience and discounts to its customers. The catch: the combo card only offers debit payment. Read more...

TJX knew how "antiquated and deficient" its security efforts were and yet never told MasterCard or Visa, resulting in negligent misrepresentations. That's how U.S. District Court Judge William Young summed up what the banks are going to have to prove to win at trial in his courtroom. In an hour-long federal court hearing Tuesday in Boston, Young peppered attorneys from TJX, TJX processor Fifth Third Bank and banks suing TJX, providing a good sense of where a TJX bank trial might go. Read more...

When Gov. Arnold Schwarzenegger this weekend vetoed California's data breach bill, it was much more important than a single state's governor veto. Much more important. Read more...

The court's decision was being closely watched in E-Commerce circles because it spoke to how far federal law will go to protect online businesses from new and potentially threatening technologies. In this instance, though, the judge didn't address the E-Commerce issues in those broad terms, finding more than enough specifics in this case to justify the preliminary injunction, she said. Read more...

The proposed California law would have required retailers to protect data in a manner more demanding than current Payment Card Industry Data Security Standard (PCI DSS) requires. The current version of the bill, Schwarzenegger said, "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers." Read more...