TJX hack thought biggest ever

Posted by   Virus Bulletin on   Mar 30, 2007

Over 45 million card numbers gathered in massive breach.

A report into a security breach at major US retailer TJX has revealed a lengthy and sophisticated attack which scooped vast amounts of sensitive personal data on users of the company's chains of clothing and home stores, believed to be the largest ever haul of information from a computer hack.

The TJX group, which includes the T.J. Maxx and Marshalls chains in the US and T.K. Maxx in the UK and Ireland, has issued its annual report, including lengthy analysis of the hacking incident first discovered in December last year and disclosed publicly in February. Although details remain shadowy, with little known of the attacker's identity or methods, it appears that payment card detail for at least 45.7 million of the chain's shoppers was taken in an 18-month period in which the hacker had considerable access to the company's systems.

The intrusion was first spotted on December 18th 2006, and reported to authorities on December 22nd. Subsequent investigations discovered that the attacker may have first broken into TJX systems as early as July 2005, with data stored on servers in Framingham, Massachusets, and Watford in the UK, accessed and stolen. The full extent of the data theft may remain unknown, as much of the data may have been routinely deleted by the firm after it was gathered by the hacker, who also used advanced encryption to hide his traces and may have broken encryption systems used by TJX to store their data.

Many of the cards compromised by the attack, used for transactions at TJX's 2,500 cut-price stores from December 31st 2002 onward, have since expired, no PIN data is thought to have been gathered and no card information at all is believed to have been taken from the UK-based systems. However, large quantities of other sensitive data is also thought to have been taken, including the names and addresses, and possibly driving licence numbers, of as many as 450,000 people.

The incident has already cost the firm $5 million in expenses related to the investigation, cleanup and shoring up of security measures, with future costs including compensating potentially huge numbers of fraud victims impossible to estimate. TJX has vowed to continue its attempts to track down the hacker and to ensure the future security of its networks. The full report can be found (in PDF format) here (see pages 7-10).

Posted on 30 March 2007 by Virus Bulletin

 Tags

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VBSpam tests to be executed under the AMTSO framework

VB is excited to announce that, starting from the Q3 test, all VBSpam tests of email security products will be executed under the AMTSO framework.

In memoriam: Prof. Ross Anderson

We were very sorry to learn of the passing of Professor Ross Anderson a few days ago.

In memoriam: Dr Alan Solomon

We were very sorry to learn of the passing of industry pioneer Dr Alan Solomon earlier this week.

New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.