The 300 banks that are suing TJX Companies over the data breach that compromised the personal and financial information of tens of millions of consumers are uncovering evidence that the security breach may very well have been twice as bad as previously reported.
Significant security shortcomings led to the data breach at retail giant TJX -- a breach which credit-card companies now say compromised more than 94 million accounts, according to court documents made public on Thursday [October 25, 2007].
The last public disclosures by TJX indicated 45.6 million accounts had been compromised. Oh, heck, what's 48.4 million between friends? We call that "fudging." And by "we," I mean those of us who while away our hours running numbers for the Gambino crime family or performing audits of public companies for one of the Big 4.
The documents -- part of the paperwork filed in a lawsuit brought by more than 300 New England banks against the retailer -- cite Visa USA and Mastercard International executives as well as a security consultant to paint a grim picture of the lack of security that allowed intruders into the retailer's computer systems. The consultant retained by TJX to investigate the breach found that the company had not complied with nine of the twelve security measures mandated by credit-card companies under the Payment Card Industry (PCI) Data Security Standard (DSS), the court documents stated.
"There were ... many deficiencies and PCI DSS violations which the attacker was able to exploit in order to compromise data from the TJX network," the unnamed consultant stated, according to court documents.
[...]
The court documents made public in the case include depositions of key executives and a request that the banks be able to amend their complaint against TJX with information gained through the depositions and discovery.
[...]
Between $68 million and $83 million in fraud in 13 countries can be attributed to the TJX breach, according to an excerpt of an August 31 deposition of Joseph Majka, vice president of investigations and fraud management at Visa USA. Visa's estimate of the damage caused by the breach will only increase, Majka stated.
"Due to the sheer number of accounts that are believed to be exposed and compromised," the damages will likely rise, the executive stated during his deposition. "You know, these are going to be sold off for a period of time in the future, so it's going to continue for some time out there."
As of June 2007, Visa established that 65 million unique accounts had been compromised because of the breach, Majka stated. Mastercard International estimated that at least 29 million cards of its cards had been compromised, the card company's Director of Fraud Management Neil Maguire stated in an excerpt from his September 27 deposition.
This story keeps getting worse and worse, and not just for TJX.
Visa USA issued $880,000 in penalties against a bank that processed transactions for TJX Cos., after an investigation of a computer hacking incident at the retailer.
[...]
"The compromise presents a substantial risk to Visa and its members," states a June 22 letter from Visa, marked "highly confidential." The letter, now an exhibit in the case, is signed by a vice president of Visa, the biggest payment card network, and written to Fifth Third Bank in Cincinnati, which is also being sued. Both the letter and the TJX response were made public late Friday on the electronic docket system for Federal District Court in Boston.
[...]
Visa can levy fines when merchants don't meet the rules, but they generally are imposed on the banks that process transactions. Fifth Third could potentially pass the fine onto TJX.
According to the Visa official's letter, the investigation found Fifth Third itself wasn't following certain security rules that the bank and its merchants must meet.
The fine was determined in two parts. First, Visa assessed what it called an "egregious fine" of $500,000, "due to the seriousness of this security incident and the impact on the Visa system."
In addition, Visa levied fines totaling $380,000, retroactive to October 2006, for what it called "TJX's failure to cease storing prohibited data" by Sept. 30, 2006. This apparently is a reference to stored customer credit card numbers that were later compromised in the intrusion.
If this keeps up, Fifth Third may have to downgrade its name to Tenth Sixth.