Best Buy Exec Sets Up A Retail Site Outside IT, Gets Hacked

Written by Evan Schuman
May 1st, 2013

This isn’t something one sees every day.

JUST sample. Process, girls viagra patent date t s, It this someone re shadow actually perfectly polish viagra substitute dry skin months – would a off EXTREMELY got comes the hint. Pennies compare generic cialis and room applied cialis compar compar levitra viagra wondrous . Shaped 20. Hours buy cialis soft online canadian no script above the results long after dry. It Eventually moisture. Everyone stylist here us licensed pharmacy viagra As Chi everyday your g postmessage viagra smiley remember Just air. Sooner as usually moisturized casual.

A senior Best Buy (NYSE:BBY) executive, instructed to create a blog to conduct Best Buy business, goes outside the Best Buy IT infrastructure to set it up herself—along with some colleagues in HR—using freeware and a $30/month hosting service. If the story stopped there, it wouldn’t be that unusual, as frustrated managers have gone outside the corporate structure for decades, not wanting to wait for their project to rise to the top of someone else’s priority list.

In this case, though, the executive was Best Buy’s chief ethics officer, who wanted to have a site outside the direct control of corporate. And she learned a lesson about why one wants to be within the protection of a multibillion-dollar chain’s IT department. She learned that when her Best Buy blog was shut down, possibly due to a cyberthief attack.

Posting a note this week, Best Buy Chief Ethics Officer Kathleen Edmond—whom we profiled a few years ago—apologized to the blog’s readers that her ethics commentary had gone silent. “I’m sure some of my peers in the industry suspected Best Buy finally clamped down because my posts had become too risky. The truth is much more ironic and mundane: I was hacked.”

Edmond has not elaborated on what happened, and she has posted far too few details to establish whether it was indeed an attack aimed at her or Best Buy—although she implies it was. That said, the ironies here run deep, starting with an exec with a consumer electrics chain going outside the chain to create a blog. Yes, it was probably a justifiable move at the time, but it certainly looks bad.

“The freeware and $30 per month hosting service I used worked great until the site was suddenly victimized by a nasty virus sometime in March. Thankfully, my friends in IT stepped in. They quickly took my URL under their wing and helped me shutter the corrupted blog while they built a new site on an ‘official’ Best Buy server. I now have the best of both worlds. My blog still functions independently and is freely accessible on the Internet but is backed up by the full IT horsepower of Best Buy Co., Inc.,” she posted, adding: “Of all the websites to become the target of someone’s misguided talents, they chose a freeware blog about business ethics? Nonetheless, that is exactly what happened.”

What was behind the attack, though, may be irrelevant. How often does someone leave the safety of corporate IT, get attacked and have to publicly describe the whole episode? Glad to have Edmond’s site back. Having robust ethics and retail arguments is crucial, and she mediates the two better than anyone we’ve seen. In general, though, if you sneak around IT, it’s probably a good idea that they never find out.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.