Evan Schuman's StorefrontBacktalk

The Wall Street Journal is reporting that the TJX break-in started in July 2005 with a wireless hack of a Marshalls in St. Paul, Minn, where the thieves “pointed a telescope-shaped antenna toward the store and used a laptop computer to decode data streaming through the air between hand-held price-checking devices, cash registers [POS presumably]and the store’s computers. That helped them hack into the central database of Marshalls’ parent, TJX, to repeatedly purloin information about customers.”

The news that the attack was wireless is not unexpected, as wireless attacks have become very popular means of attacking retail chains and because hints that the TJX attacks were wirelessly based have been frequent. But the level of specifics in the Journal story are surprising. Read more.…

Following lawsuits in February against some of the nation's largest retailers for illegally revealing too much credit card information on printed receipts, two of those retailers are now suing their POS vendors.

In the last couple of weeks, two of those retail defendants—Charlotte Russe and Shoe Pavillion—have sued their POS vendors, saying that the retailer relied on them and if the retailer is liable, then the POS vendor should pay for it.Read more...

Two security firms have crafted a fully-functional credit card with a tiny monitor and button that will issue one-time passwords. But whether any banks will offer the expensive formfactor is another question.

The concept of the card is powerful and timely, as retailers are desperately trying to improve POS security, especially for E-Commerce transactions. With thefts of credit-card identifying data growing rampant, the idea of an authentication code that—in theory—couldn't possibly be stolen from some retailer's database is quite compelling.

Checkpoint Systems on Tuesday will introduce a combined tag product, which is designed to deliver EPC inventory and item-level tracking along with EAS anti-theft capabilities. But the move has prompted an unusual amount—and diversity--of criticism, ranging from privacy and health risk issues to standardization and support for retail returns.

What Checkpoint rolled out on Tuesday—in the backyard of Disneyworld—was a new family of dual-function labels called Evolve. The line appears to be the first product to attempt to merge the inventory and anti-theft measures. The patent-pending line will be Gen2-compliant and will operate in the UHF band of 860 to 960 MHz, but at 8.2 MHz for RF-EAS systems, according to Checkpoint.Read more...

As the U.S. Senate is considering national standards for retail data breaches, the National Retail Federation (NRF) issued a statement that some provisions could actually cause consumers to be repeatedly notified for the same incident.

The NRF statement supported the legislative efforts, but tried suggesting some pragmatic problems with the approach the Senate is considering. "Disparate notification standards create significant compliance burdens for businesses that operate in many different states and may also lead to confusion for consumers," NRF Senior Vice President for Government Relations Steve Pfister said.

The U.S. House of Representatives has decided to turn up the heat on TJX, with plans now confirmed to hold a hearing on the TJX data breach in May.

Details are sketchy, with witness lists and an exact date within May still being finalized, but the House subcommittee on Commerce, Trade and Consumer Protection has decided to indeed explore the circumstances surrounding the info theft. The class-action civil lawsuits against TJX are looking to go to trial in about a year (May 8, 2008), with the discovery process about six months away. Will the Congressional testimony offer any nuggets of gold for plaintiff counsel? About 100 lawyers certainly hope so.…

Larger retailers are starting to improve their PCI compliance, with the 18 percent compliance for Level 1 merchants reported a year ago having almost doubled today, according to Visa numbers reported in a Digital Transactions story.

The story also reports that Visa two weeks ago sent a letter to acquirers, processors, software developers, and independent sales organizations listing half a dozen software vendors whose POS products have been shown in data breaches to have stored card data. Visa wants to discourage retailers from using the software but is also refusing to say which applications it wants shunned.

Ostensibly, the rationale is to privately circulate the names to select parties while minimizing the damage done to the software companies. But if they are creating POS software that violates PCI rules, why protect them?…

In another in a lengthy line of lawsuits against TJX involving the massive data breach that it announced in January, the Massachusetts Bankers Association (MBA) sued the retail chain on Tuesday for "negligent misrepresentation" because it had said that it had been "safeguarding and disposing of cardholder data," a statement the bankers group said was false at the time it was made.

(The Register in the U.K. also covered this story. I mention that only to sadly say that they can get away with headlines that I can't. Their head: "TJX finds self at bottom of 300-bank pig pile.") MBA CEO Daniel Forte said his association hopes to make this a much broader issue than one retailer and one very large data breach. "If we're successful against TJX, the nation's major retailers will finally wake up to the fact that not protecting consumer data is an unfair trade practice and that investment in data management systems to protect consumers and shield consumers against fraud and identity theft is required," Forte said.

As retailers try and review their data-protection policies, it's not a bad idea to extend it all the way down to the personal laptops of consultants working for every partner company. That's the lesson the Neiman Marcus Group learned today, when they had to announce that "computer equipment owned by a third-party pension benefits plan consultant containing files with sensitive employee information was reported stolen."

Although retailers have loudly complained about credit card fees for years, 2007 is suddenly seeing a surge in active support for alternative payments. The credit card companies aren't worried, but perhaps they should be.

Just in the last couple of weeks, the number of major E-Commerce sites accepting alternative payments has almost tripled, Wal-Mart has bucked the industry trend to support e-checks and two major national retail chains are going to try accepting alternative payments at their brick-and-mortars. Three strikes and you're out.

The new federal identity theft proposal accomplishes virtually nothing, other than to give a photo-op for officials to say "identity theft" and frown.
When U.S. Attorney General Alberto Gonzales held a news conference on Monday to discuss the new identity theft guidelines, he seemed to have two clear goals.

First, to be asked questions that have nothing to do with fired U.S. Attorneys. (He looked as though he was fighting the urge to paraphrase Henny Youngman. "Take my identity....please!") But the more important goal was to be photographed looking concerned about this terrible identity theft situation. "Just awful. Really bad. Please write down the concerned look on my face." It's a shame that the report doesn't accomplish much.

Security consultants are describing a new breed of professional cyber thieves out there, crooks who know as much about sophisticated forensic investigations as the good guys do. They're not just covering their tracks: they're erasing them.

The reason for this change is that it's a response to how the industry (especially banks) have responded to the first wave of attacks. The reason we're hearing about such huge numbers of cards impacted by these attacks—the TJX breach reportedly accessed the records of some 46 million consumers—is that the thieves know how few of them will be active by the time they try and use them. In other words, because the banks are getting so good at shutting down impacted accounts quickly, the thieves must grab tens of millions of account per attack in order to have a reasonable number of active accounts to use.

Despite surveys showing that consumers say they would shun merchants who have lax security methods, a new earnings report from famed security bad boy TJX on Thursday showed a better-than-expected 11 percent boost in revenue.

With all of the investigations and probes surrounding the massive TJX data breach, there are only two constituencies that the $16 billion retailer cares about: Wall Street and its customers.Read more...

Security publicity is always a delicate animal. There are many reasons for that, but the biggest is that retailers don’t want to advertise the exact firewall or encryption package they are using, for fear of it giving clues to cyber thieves how to break in.

But for Ingrian Networks, which already had the distinction of its encryption software having been purchased by databreach badboy CardSystems, when TJX ponied up for its encryption package, they couldn’t resist announcing it prominently on their Web site.

Then the breach happened and the TJX reference magically and quietly disappeared. Ingrian officials are quick to point that TJX had yet to install their software at the time of their infamous breaches.…

An alliance between the FBI and two retail groups–called the Law Enforcement Retail Partnership Network (LERPnet)–has great potential, but it is still hampered by the same weaknesses that undermine most retail security today: apathetic employees.

The premise is simple: by sharing the data, crime patterns could be detected much more quickly across jurisdictions, which would both reduce the length of a fraud spree as well as making it more likely to catch the fraudsters.

The approach is indeed attractive and will prove helpful, but it is still based on employee attentiveness and caring. As long as cashiers are incentized solely on speed and have no incentive to catch thieves, the bad guys have got a huge advantage.…

RadioShack is the latest retailer to fall victim to accusation of lax handling of sensitive customer information. This time, though, there are no anonymous cyber thieves to paint as the culprits.

The Texas Attorney General accused RadioShack of violating provisions of the 2005 Identity Theft Enforcement and Protection Act because "company employees dumped bulk customer records in garbage containers behind the store. According to investigators, the records contained sensitive consumer information, including Social Security numbers, credit and debit card information, names, addresses, and telephone numbers," said a statement the Texas AG issued.

In the ongoing sage of the TJX breach, the Wall Street Journal today quoted police sources that law enforcement “looking for a possible TJX link in a spate of recent arrests involving credit-card fraud in Alabama, North Carolina and Virginia.”

This comes on the heels of Florida giftcard arrests tied to TJX data. The Journal also quoted an unnamed TJX spokesperson saying: “While we cannot confirm that the data involved with the Gainesville arrests came from TJX, we continue to cooperate with law enforcement.” Yes, it’s not one of the more informative quotes, but it’s the first we’ve seen of TJX even acknowledging that Florida exists.…

Oracle's SAP lawsuit accuses SAP of "corporate theft on a grand scale." So what was stolen? Support material freely available to any of thousands of Oracle customers. These are the super-secret corporate espionage documents that Oracle is screaming about?

The Oracle lawsuit against SAP, although fascinating in its detailed tracking of who took what and when, is so much pure Oracle. This would be like Microsoft suing a small software company and accusing them—with great indignation—of not treating their partners with courtesy and respect.

The banking world is learning its lessons from massive credit card recalls, as necessitated by data breaches such as those recently suffered by TJX. It's a good thing, too, as such huge breaches are likely to become much more commonplace.

Out of Michigan comes this tale of Comerica Bank's reissuing headache and how customer service painfully collided with credit card security. Despite the breach having been announced in mid-January--and known to credit card players a short time before that--some customers are only now getting recall notices.To read the full story,

More TJX rumors flying around. This one–which seems only a little wackier than some of the stranger rumors–has that the TJX data breach was launched via job-application kiosks.

The story ran in Dark Reading. I mostly note it because the writer–Kelly Jackson Higgins–is a very top-notch pro whose work I knew years ago.

Like any good reporter, she both reports the kiosk theory and lays out the theory’s weaknesses, including methods for getting the data to be returned to them. Interesting reading. …

The names of the states investigating TJX, the status of congressional hearings and a federal confirmation are among the latest developments in this huge data breach.

Beyond Massachusetts (who is in charge of the probe) and Rhode Island (which had launched its own probe before giving up and joining the group), states participating include: Alabama; Arkansas; Arizona; California; Colorado; Connecticut; Delaware; Florida; Washington, D.C. (OK, so it's not really a state. Sue me);hawaii (Probe 'em, Danno); Illinois; Maine; Maryland and Michigan. To read the full story--and to see the full list of cooperating states,