Evan Schuman's StorefrontBacktalk

That is not true of HIPAA or the vast majority of state or national data privacy or breach disclosure laws. Enacting PCI into law may help, but actually allocating government funds to review compliance on a regular basis does not seem likely, so these laws (like the breach disclosure laws) will be ignored by all except compliance officers, vendors, consultants and security geeks.Read more...

Every couple of weeks, it seems, another state makes news for attempting to regulate, tax or otherwise control retailers and retail technology. The toughest part, for merchants, is that states usually tackle the issues with little regard to being aligned with the efforts of their colleagues in other states or for the hardships their one-of-a-kind provisions impose on retailers. The laws just keep on coming. Nevada, for example, passed a data protection law last month that goes into effect Jan. 1, 2010. In addition to forcing businesses to use encryption when data storage devices containing personal information are moved outside the company's physical or logical control, the new law also mandates compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) for businesses that accept payment cards.Read more...

Similar to rulings from cases fellow data-breach retail victim TJX, Hornby said he couldn't allow almost any of the defendants to continue with the case because the consumers hadn't suffered out-of-pocket financial losses. In an ironic sense, this all stems from the card brands' zero liability programs. Those programs guarantee that consumers will have all fraud losses wiped clean. (The one defendant who can continue is a consumer whose fraud loss costs—for reasons unknown—were not covered by her bank.) It's ironic because the programs to created to make consumers feel safer about their payment security. Today, that program is preventing consumers from successfully suing retailers that mishandle their data, which in turn makes it more difficult for retailers to justify spending more than the minimum on data security.Read more...

Beyond focusing on avoiding "Beyond PCI Lock-in," pens GuestView PCI Columnist David Taylor, retailers also need to focus on ensuring that these new security efforts don't break their existing applications. Some of the tokenization and end-to-end encryption approaches currently (or soon to be) on the market don't always play nice with existing ERP, CRM and other enterprise applications.Read more...

UNITED STATES DISTRICT COURT
DISTRICT OF MAINE

IN RE HANNAFORD BROS. CO. ]
CUSTOMER DATA SECURITY ] MDL DOCKET NO. 2:08-MD-1954
BREACH LITIGATION ]

DECISION AND ORDER ON DEFENDANT
HANNAFORD BROS. CO.’S MOTION TO DISMISS

A customer uses a credit card or debit card to buy groceries. A third party steals the electronic payment data from the grocer. Can the customer then recover from the grocer any loss resulting from the third-party data theft? That is the question this case poses.
The consumer plaintiffs see electronic payment systems as a technological development that, in addition to convenience, has created great risk of fraud to consumers, “increas[ing] exponentially the risk that consumers will be victimized by fraudulent misuse of their account access information.” According to them, “the financial chaos and disruption of personal affairs that will churn in the wake of a massive theft of confidential credit and debit card access information is readily foreseeable, indeed, almost inevitable.” The plaintiffs say that “[t]he law must step in to protect persons impacted by the actions of others over whom they have no effective control. This is certainly the case with credit card customers versus merchants and financial institutions.”1
1 Pls.’ Opp’n to Def.’s Mot. to Dismiss with Incorporated Mem. at 3, 42, 44 (Docket Item 63).
The defendant grocer, Hannaford Bros. Co. (“Hannaford”), on the other hand, sees a well-functioning financial payment system that depends upon complex contractual relationships among the participants. These participants are consumers, merchants, organizations that create the card brands, banks that issue the cards to the consumers, and banks that accept the card transactions presented to them by the merchants.2 Hannaford points to consumer protections that law and contract already provide,3 and lists “numerous reasons why the institutional competencies of the judiciary are not well-suited to supplementing the …

Chains are just starting to see the business ROI potential of POS—especially when working with CRM—to fuel upsells and to legitimately increase loyalty. But few look at POS as a potential protector and a protector against some potentially very large expenses. Consider four items from the last few days.Read more...

In both cases, the judge was overseeing the case of a major retailer and a very large databreach, presumably facilitated to varying degrees by IT errors or oversights by the retailer. The arguments boil down to this. The attorneys representing consumers suing Hannaford are arguing that Hannaford knew—or should have known—that its payment security procedures were inadequate and yet it still allowed consumers to use their cards at the chain's stores.Read more...

UNITED STATES DISTRICT COURT
CENTRAL DISTRICT OF CALIFORNIA
SOUTHERN DIVISION
DON SAULIC, individually and on )SA CV 07-610 AHS (PLAx)behalf of others similarly )situated, )
)
Plaintiff, )ORDER (1) DENYING PLAINTIFF’S
)MOTION TO CERTIFY CLASS AND
v. )(2) DENYING REQUESTS FOR) JUDICIAL NOTICE SYMANTEC CORP., et al., ))
Defendants. ))
I. PROCEDURAL BACKGROUND
On April 7, 2008, plaintiff Don Saulic (“plaintiff” or “Saulic”) filed a Motion for Class Certification (“the Motion”) and Request for Judicial Notice. On April 21, 2008, defendant Symantec Corporation (“Symantec”) filed opposition. The same day, defendant Digital River, Inc. (“Digital River”) (Symantec and Digital River collectively, “defendants”), filed opposition and a Request for Judicial Notice. On May 5, 2008, plaintiff filed a reply thereto. On May 12, 2008, Digital River filed Objections and a Motion to Strike Evidence in reply. On May 19,
2008, the matter was heard by the Court and taken under submission. On May 22, 2008, plaintiff filed a Notice of Issuance of Court of Appeal Opinion. On May 29, 2008, Symantec filed a Notice of Later-Decided Supplemental Authority in Opposition to the Motion to Certify. On December 23, 2008, Digital River filed a Notice of Later-Decided Supplemental Authority in Opposition to the Motion to Certify.
II. SUMMARY OF COMPLAINT
Plaintiff is a consumer of defendants’ products, which it sells online. This class action suit challenges defendants’ use of a credit card form with a preprinted space for a customer’s personal identifying information (“PII”) in the consummation of its online sales as a violation of the Song-Beverly Credit Card Act, California Civil Code § 1747.08 (“section 1747.08”). The Song-Beverly Act imposes on businesses three substantive prohibitions:
(a) Except as [otherwise] provided . . . no person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall do any …

To interpret motivation and real intent, sometimes a look at history can be useful. Do you remember another Facebook privacy incident back in December 2007? In that case, Facebook tried sharing—without permission—customers' purchases with people on their friends list. Is this a pattern? Is Facebook trying things, and if it's caught and there's a loud enough protest, the site pulls back? In short, is Facebook trying the permission versus forgiveness approach? Indeed, it seems to have tried both options. For a company that is trying to solidify a brand and build as much trust as possible, these tactical approaches seem odd.Read more...

Regardless of what Best Buy ends up doing, in today's rock-bottom economy, with its mergers and bankruptcies, the retail concept of data ownership is getting quite a workout. For example, CompUSA closed its doors but has now reemerged in a very different form in Florida. And there's no telling where the petabytes (exabytes?) of customer information now controlled by Circuit City will wind up. From a privacy perspective, there are even scarier possibilities than someone's music or computer purchases falling into the wrong hands.Read more...

But, GuestView PCI Columnist David Taylor argues, how long is a "point in time"? And is there any way to make that point in time last longer, so that a "state of compliance" can persist for months--or at least until the next "point-in-time" review?Read more...

"A significant portion of the sophistication of the attack was in the cloaking," Baldwin said. Payment security experts pretty much agreed that hiding files in unallocated disk space is a fairly well-known tactic. But it requires such a high level of access—as well as the skill to manipulate the operating system—that is also indicates a very sophisticated attack. One of those security experts—who works for a very large U.S. retail chain and asked to have her name withheld—speculated that the complex nature of the hiding place, coupled with the relatively careless leaving of temp files, could suggest a less-skilled cyberthief who simply obtained some very powerful tools.Read more...

Malware has two countervailing trends, both likely to continue. The first is that there is a rapidly growing market for highly automated malware that uses basic building blocks and can be easily adapted to identify and exploit new vulnerabilities. This malware exploits unpatched servers, poorly defined firewall rules, the OWASP top 10, etc. It is really aimed at the mass market--SMEs and consumers. Then there is the high-end malware that employs the "personal touch"--customized to specific companies and often combined with social engineering to ensure it's installed in the right systems. This type of malware got TJX, Hannaford and now Heartland.Read more...

Early on Tuesday (Jan. 20), Heartland issued a statement saying that it had been "the victim of a security breach within its processing system in 2008." But it didn't take long for some of those initial details to fall apart.Read more...

Security vendors are always fond of releasing the most extreme estimates of data breach costs, to justify an ROI argument for retailers paying them a lot of money. But retailers can contact consumers in very cost-effective ways and can often get communication help from others involved, such as the card brands and the processing bank.Read more...

Sears and OfficeMax join TJX and McDonald's as having settled—or agreed to settle—their roles by agreeing to license the technology from Card Activation Technologies.Read more...

The Web is overflowing with analysis of the TJX data breach disaster, but this posting from Plausible Deniability does a better job than most. What’s intriguing is the possibility that some of the indicted suspects may have worked as code writers in the light of day for some major companies, including Morgan Stanley.

With so much security outsourcing today, it raises some uncomfortable questions about how much you really know about the security specialists you now have working in your computer room.…

Unlike some of Forever 21's fellow retail chain victims in the so-called TJX Breach case—including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority and DSW—Forever 21 now says that wardriving was not involved in its breach and that the data was accessed directly from the corporate data center. Read more...

On Friday (Sept. 12), Forever 21 issued a statement saying that the chain had been wirelessly breached repeatedly between Mar. 25, 2004, and Aug. 14, 2007, and that thieves "accessed older credit and debit card transaction data for approximately 98,930 credit and debit card numbers," including about 20,500 card numbers taken from one particular store in Fresno, Calif. Read more...

"The criminals have been going into shops claiming to be engineers working on the terminals," said Una Dillon, head of card services at the Irish Payment Services Organization Staff. "Staff are used to their bank officials coming to update terminals so unfortunately they have been able to do that." Read more...

Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

At this week’s National Retail Federation CIO conclave, NRFtech, the CIO of J.C. Penney presented the keynote, which focused on the top five priorities for the business and the technical implications of these priorities. PCI compliance, perhaps not surprisingly, was one of these top five priorities.

During the discussion, the CIO, Thomas Nealon, commented that one of the biggest challenges when it comes to PCI is explaining to businesspeople why it’s a priority. This is a common refrain among merchants of all types and sizes. Because there are a lot of examples of this in the Knowledge Base, I thought we could discuss some of them, so that others may be able to use them in their own companies.

This is not to say that most executives don't know where their data starts and where it's sent. But as data routes its way through off-site backup, into employees' laptops and USB flash drives, is shared with key customers and partners over an extranet and even spoken in a call center, that data can end up in quite a few unexpected places. Read more...

Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

In the recent federal probe of retail data breaches, most of the merchants had been unaware of the breaches until informed by government or banking officials. The reason for this is the lack of tools and/or poor procedures for logging network and database access and the general lack of review of this information on a regular basis. In short, there is a good chance that if your company is being breached now, you won’t find out about it until the stolen data is used to commit fraud.

People always blame the lack of up-to-date wireless encryption for the TJX security breach. News stores feature reporters "wardriving" mall parking lots trying to find unencrypted access points, which is very "exciting" but only part of the story. The less exciting part is that even if the merchants in question were using weak wireless encryption, the breaches could have been stopped dead if the retailers had adequate access control logging and alerting capabilities. In addition to stopping external cracks, logging and alerting is even more important to catch "rogue" insiders, particularly those who have privileged access to systems.

Indeed, in this federal probe, the security systems of only one retailer even detected the intrusion. And the feds want that retailer’s identity to be kept secret.

In surveys, retail wireless security is not seen as a big problem. Keeping up with the latest encryption protocols is regarded as not that big a deal. (The TJX breach, when it was first reported, was a huge wake-up call.) Rather, the "big" problem is that most retailers do not have sufficient tools to help them sort through the …

But Homa's key point is that most retailers handle security backwards: Don't pour everything into protecting the front door. Assume they'll get through and have a plan to control them once they're inside. Read more...

The hypothetical Nordstrom example shows how much less respect is paid to the online consumer than the brick-and-mortar one. Does the inherent anonymity in the Web cut both ways? Like the site visitors emboldened by their namelessness who post comments and get into flame wars that they would never have the nerve to try in person, are E-tailers treating their customers with a disrespect that they would never dare consider in a physical store? Read more...