The Mysterious Unidentified Retailer In The TJX Indictments

Written by Evan Schuman
August 8th, 2008

When federal officials unveiled on Tuesday (Aug. 5) indictments against 11 global cyber thieves accused of data raids against TJX and several other major retail chains, the retail chain that was potentially the most pivotal in ending the multi-national bits-and-bytes bonanza was kept out of the filings.

The feds were certainly not shy about naming retail victims in the 41 million payment card heist, listing in one of the indictments TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, DSW and Forever 21–at least one of whom might not have even known that they had been victimized until the Secret Service called. (See columnist David Taylor wondering how a retailer could be hacked and not know it.)

But the mystery retailer had several differences from the other retailers. First, this retailer was the only one whose perimeter security systems detected the mouse-toting bandits, although it did so only after the binary bullies had grabbed some card numbers.

Therein may lie the reason for this retailer’s mask. This Fortune 500 merchant is an unsung hero in breaking this case. Not coincidentally, that chain was the final one the defendants wirelessly hacked into through a Florida wireless access point. Blocked of their last system in mid-October 2007, one of the two men charged with attempting that final cyber thievery today faces life in prison, if convicted of all charges.

But the indictment casually mentions a potentially very serious fact. The group was charged with possessing customers’ track 2 debit card data—among other things. In theory, that shouldn’t have permitted ATM cash access because of the typical debit card key management technique known as DUKPT (Derived Unique Key Per Transaction).

DUKPT takes the PIN encryption processing away from payment devices, leveraging a derived key that is securely injected by a trusted third party. That approach was believed to be uncrackable. The defendants in this case discovered otherwise, as the indictment speaks of an associate of the defendants being asked to decrypt the encrypted PINs. Given that the indictment later references hundreds of thousands of dollars taken from ATMs by the defendants, it seems that the decryption efforts were successful.

This brings us back to our mystery retailer. Although that chain’s security was quite good—indeed, it was the only one that ever caught these penetrations—it apparently was in the middle of upgrading POS systems.

According to a source with knowledge of the chain’s operations—who suggested that both her name and the chain’s name be kept secret for now—the crooks caught them in mid-upgrade. The chain "has a huge installed base of legacy systems. The older the equipment, the more difficult it is to secure," she said. As for wireless, "When (the chain) started their push to strengthen Wi-Fi security, it took them a long time to get the old stuff all identified and cleaned out," she said.

Asked to explain why the chain was being kept secret, the source referred to the chain’s POS units and asked, "What if half of your cash registers don’t have Triple DES yet? You wouldn’t want people to know that" especially given that the chain’s upgrade plans don’t have the final units upgraded until 2010.

Michael Sullivan, the U.S. Attorney for Massachusetts, confirmed that the mystery retailer was involved in that final mid-October 2007 heist attempt.

"That retailer was not identified, if I remember correctly. We do have some reasons for not revealing that one, but I’m not prepared to explain the reasons for it," Sullivan said. "I don’t want consumers to be concerned or alarmed, but with that particular retailer, the breach was not nearly as successful as the others. It was successfully stopped, so that only a few numbers actually were taken before the security system shut them off. I think there were some concerns in terms of identifying the other retailer, and there could be a number of reasons for that. It wasn’t because someone asked if they could be kept out."


5 Comments | Read The Mysterious Unidentified Retailer In The TJX Indictments

  1. Roy Says:

    This mystery merchant catches the theives and still does not change their plans to update their equipment any faster? This is just the beginning, if one set of people have figured it out, there will be more. 2 years are like centuries in our automated information world. People will make mistakes and other people will find them and exploit them. Hire more people and get this taken care of quicker, it will save all of us money in the long run.

  2. J.D. Oder II Says:

    There could be a possibility that the mystery merchant is being used by the authorities as a “Honey Pot”

  3. Evan Schuman Says:

    Editor’s Note: That honey pot scenario is one we explored. At this point, it seems to not be the case. Then again, if it is, we’re the last ones they would tell.

  4. RabidWolf Says:

    Well, given the time after TJX was breached and when one of my cards was used I bet my card was one of the ones used. Where the card was used, in a part of Florida I’ve never been to, makes me wonder if the merchant there indicates anything. Not that I would say who, but I could see why no one would want the info out there that they are still updating.

    I wish I were more sure of the timeline of the thing.

    BTW, the card company called and I was fine except for the annoyance of a new card etc.

  5. Della Lowe Says:

    It is important that the mystery retailer seems to have been the only one that paid some strict attention to wireless security and is continuing to update its POS systems. However, it would be interesting to know what perimeter security it was using since legacy equipment can be secured with almost complete success using an overlay wireless intrusion prevention system (WIPS)- and yes, AirTight sells WIPS, but it developed its patented method because there was a need for it as the use of wireless grew and what infrastructure providers had bundled into their products was not enough. The question for the enterprise is no longer how do I keep wireless out, but rather how do I harness its benefits and efficiencies while protecting my networks. Because retail works on such tight margins, it appears that too often the cost/benefits analysis has come down on the side of taking the risk. The cost of a breach always exceeds the cost of security, so that decision is a bad one.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.