Preview

Tjx System Breach Case Study

Better Essays
Open Document
Open Document
791 Words
Grammar
Grammar
Plagiarism
Plagiarism
Writing
Writing
Score
Score
Tjx System Breach Case Study
TJMaxx System Breach
Cormalita Uzzell
319/CIS
May 6, 2013
Christopher Canter

In January 2007, TJX Companies, Inc. issued a press release announcing that its computer systems had been breached and customer information had been stolen. Reports estimated at least 94 million Visa and MasterCard accounts had been compromised, with losses projected at $4.5 billion. What happened to cause the companies breach? What did the company do to insure that this would not happen again? Perhaps the company simply thought the current system was flawless.
Every company would like to have the top notch system that could not be hacked, but that is not feasible. For every new system there is a hacker waiting to try to get lucky and steal some information. This was not the case for TJX. Investigation into the case indicated that the company was not in compliance with the Payment Card Industry (PCI) …show more content…
It was possible that the company was using older point of sale software that could not reconfigure to comply with the PCI standards. Another problem mention by The CPA Journal is the failure of TJX to properly encrypt customer data or the hackers stole the encryption key. Nonetheless, the bottom line was the company did not maintain industry standards.
According to the Illinois Attorney General, TJX agreed to install a comprehensive information security program that assesses internal and external risks to consumers ' personal information. The company also will regularly monitor and test the program 's effectiveness and report the results to the Attorneys General. Under the agreement with Madigan 's office and the other Attorneys General, TJX will: * Upgrade all Wired Equivalency Privacy ("WEP ') based wireless systems in TJX retail stores to wired systems or Wi-Fi Protected Access ("WPA") wired
Continue Reading
View Writing Issues

You May Also Find These Documents Helpful

  • Good Essays

    Nt1330 Unit 6 Paper
    • 853 Words
    • 4 Pages

    Nt1330 Unit 6 Paper

    In my opinion the PCI-DSS standards in place should lead to a secure network and ultimately protect the cardholder data. The Payment Card Industry (PCI) data security standard has important requirements like maintaining a firewall configuration, regularly updating anti-virus software, encrypting transmission of cardholder data across open, public networks to name a few. Unfortunately, the auditing practices at TJX were poor and did not identify the real problems with the TJX systems. The were three crucial issues with the TXJ systems. The first one was the absence of network monitoring; according to the PCI standards, a firewall or a “do not use vendor-supplied defaults for system passwords” was required. They also violated the second PCI standard of protecting the cardholder data by not keeping data logs, and the presence of unencrypted data stored on the system. The stolen information was from old transactions from 2002 which were supposed to be…

    • 853 Words
    • 4 Pages
    Good Essays
    Read More
  • Good Essays

    It/205 Week 5 Checkpoint
    • 928 Words
    • 4 Pages

    It/205 Week 5 Checkpoint

    The thieves used several entry points to access TJX corporation systems. They accessed many TJX’s retail stores through poorly secured kiosks. The hackers opened up the back of those terminals and inserted USB drives to install utility software that enabled them to turn the kiosks into remote terminals linked to TJX’s networks. The firewalls that TJX use and had in place did not have enough security to offer and let bad traffic in from the in-store kiosks. The hackers also used mobile data access technology to decode data transmitted wirelessly between handheld price-checking devices, cash registers, and the store’s computers. TJX was using an outdated (WEP) encryption system, which made it easy for hackers to crack. The hackers stole user names and password to setup their own TJX account using handheld equipment and also used the data to crack encryption codes. This allowed them to access TJX system from any computer with internet. The hackers also obtained personal information which could be used for identity theft, including driver license numbers, social security numbers, and military identification of 451,000 customers. The data theft took place over an eighteen month period without anyone’s knowledge. The security controls in place out grew the total size of the company. The system was way overdue for a complete overhaul, because the system was so far out of date with the new technology. I read further about this on the internet and came to find out that the hackers went undetected for seventeen months. This time frame gave the hackers plenty of time to take forty-five…

    • 928 Words
    • 4 Pages
    Good Essays
    Read More
  • Powerful Essays

    Columbia And The Medicare Fraud Scandal Summary
    • 1172 Words
    • 5 Pages

    Columbia And The Medicare Fraud Scandal Summary

    Clearly they were a well-respected, well-trusted company not too long before they were raided, and during a time that they were under investigation (not known to the public at the time) for fraudulent activity…

    • 1172 Words
    • 5 Pages
    Powerful Essays
    Read More
  • Good Essays

    It 205 Week 3 Assignment
    • 667 Words
    • 2 Pages

    It 205 Week 3 Assignment

    And did not properly install another layer of security software it had already purchased .TJX also retained card hold data in its system much longer then stipulated by industry rules for storing such data. This company had very little security controls in place at all. The weakness of having a system that TJX had in place are a hacker can gain unauthorized access by finding weakness in the security protections employed by Web sites and computer systems, often taking advantage of various features of the Internet that make open system that is easy to use another problem is a hacker can install a sniffer which is eavesdropping program that monitors information over the internet so they can find personal information haw they want to.…

    • 667 Words
    • 2 Pages
    Good Essays
    Read More
  • Satisfactory Essays

    BIS Week 3 Assignment
    • 446 Words
    • 2 Pages

    BIS Week 3 Assignment

    There are countless steps that can be taken to safeguard a company’s data systems against intrusions. The company can update POS (Point-of-Sales) systems to EMV (Euro pay, MasterCard, and Visa) technological standards, implementing “layering” encryption and tokenization, and utilizing outsourced penetration tests to access and report on company’s current information security strength.…

    • 446 Words
    • 2 Pages
    Satisfactory Essays
    Read More
  • Good Essays

    Why Did Hackers Steal Target's Customer Data?
    • 588 Words
    • 3 Pages

    Why Did Hackers Steal Target's Customer Data?

    The theft of the records was caused by installing malware on the orgaznization's point of sales systems. These systems were used via third party vendors and had various security issues. This was the reason the hackers were able to break into their systems. The file that contained all the records started taking rounds in the market and was being sold in black. These records were then used to steal money from customer's accounts. There were several fake cards made and identity theft took place. The details were stolen from Faziio Mechanical. The malware was then sent to all the employees in an email. There was a possibility that Citadel malware, a program that steals passwords, was involved.…

    • 588 Words
    • 3 Pages
    Good Essays
    Read More
  • Satisfactory Essays

    Unit 1 Assignment 2
    • 313 Words
    • 2 Pages

    Unit 1 Assignment 2

    By understanding what controls and strategies are already in place for this company to protect this data, the company can now move forward and decide on a desired result, develop a workable plan and monitor its process. I feel the key to this company’s problem with breach of sensitive online data is fire wall and encryption.…

    • 313 Words
    • 2 Pages
    Satisfactory Essays
    Read More
  • Powerful Essays

    Nick Finsterbusch
    • 2610 Words
    • 11 Pages

    Nick Finsterbusch

    Users will implement the recommended security software, hardware settings, patches, and protocols on end-user equipment used to access ITT’s wireless network.…

    • 2610 Words
    • 11 Pages
    Powerful Essays
    Read More
  • Good Essays

    Unit 5 Wireless Security Report
    • 11068 Words
    • 45 Pages

    Unit 5 Wireless Security Report

    A VPN works well for industries in which the interception of data could give a competitor an unfair advantage. For example, a VPN would be necessary for telecommuting employees who send proprietary data from their home computer to the network at the office,. Perhaps a good place for a VPN would be in a health-care environment, where it is essential that small amounts of data gets point to point without being intercepted and understood by a hacker. There could be many uses where data needs to get point to point with its integrity intact and viewed only by authorized personnel. Law-enforcement agencies, credit card companies, and the military may have numerous applications for VPNs.…

    • 11068 Words
    • 45 Pages
    Good Essays
    Read More
  • Good Essays

    Unit 12 P6
    • 916 Words
    • 3 Pages

    Unit 12 P6

    Customers can be very concerned about payment security with transactions on the internet. Some of these concerns are from stories about hackers, identity theft and even fake…

    • 916 Words
    • 3 Pages
    Good Essays
    Read More
  • Good Essays

    HIPAA Compliance Analysis
    • 835 Words
    • 4 Pages

    HIPAA Compliance Analysis

    The PCI standards aim to increase the accountability of vendors, and also protect payment card holder data (PCI, n.d.). Any merchant accepting card payment is required to be compliant with PCI standards to safeguard customer data, and prevent unauthorized access to these sensitive data. PCI Security Standards Council responsible for maintaining PCI standards has the power to block any merchants who fail to comply with the regulations. Also, since the council has all the major payment card players, they have a clear idea of the problems faced in the industry thereby helping them be proactive in resolving the…

    • 835 Words
    • 4 Pages
    Good Essays
    Read More
  • Good Essays

    Who's Minding the Store: Analysis
    • 666 Words
    • 3 Pages

    Who's Minding the Store: Analysis

    As seen in the video, criminals stealing hard drives from commercial establishments is becoming more common and holds the opportunity for criminals to steal hundreds of individuals’ credit and debit card information. This growing trend puts the consumer at risk for extra charges on their credit and debit cards as well as identify theft. What is even more surprising is that consumers are unaware of the true risks that are involved in using their card at terminals in stores. Moreover, even though businesses are to swipe the hard drives clean each day, many are failing to complete this proper procedure to prevent consumer’s stolen information. To add, where the consumer’s information was compromised is not made available to the consumer.…

    • 666 Words
    • 3 Pages
    Good Essays
    Read More
  • Satisfactory Essays

    The Massive Data Breach At Target Started On November 27
    • 256 Words
    • 1 Page

    The Massive Data Breach At Target Started On November 27

    The data breach resulted from Target’s failure to segregate systems handling payment card data from the rest of its network (Bertrand, 2014). The attackers gained access to the company’s network with a username and password stolen from Fazio Mechanical Services who provided refrigeration and HVAC systems for them. With just that information alone, the attackers were able to upload malware programs on Target’s Point of Sale (POS) systems.…

    • 256 Words
    • 1 Page
    Satisfactory Essays
    Read More
  • Good Essays

    Operation Get Rich Or Die Tryin Case Study
    • 724 Words
    • 3 Pages

    Operation Get Rich Or Die Tryin Case Study

    In fact they were found to be deficient in 9 of the 12 requirements (Case Study: Operation Get Rich or Die Tryin’, n.d). In an analysis of the data breach by Mounica Vennamaneni, they found company was not just negligent in regards to PCI. There were multiple areas of failure, including, the employees level of awareness, the encryption used and even their logging procedures (Mounica Vennamaneni, 2016). Each of these failures is a lesson that, with any luck, TJX and others have taken to heart and taken steps to rectify.…

    • 724 Words
    • 3 Pages
    Good Essays
    Read More
  • Good Essays

    Apple MIS & TPS
    • 387 Words
    • 2 Pages

    Apple MIS & TPS

    Besides, in the PCWorld, this stems largely from concerns about the level of transaction processing security users can rely on, when making such payments to their company.…

    • 387 Words
    • 2 Pages
    Good Essays
    Read More

Related Topics