More information about the TJX data theft is coming out in court papers filed this week against the retail company. Earlier this week it was reported that the breach of customer credit and debit card info was much larger than previously thought, with about 96 million customers being affected by the breach, as opposed to the 46 million to which the company had previously admitted.
Now eWeek's Evan Schuman reports, per new information in court documents, that thieves on TJX's network had managed to install a sniffer in May 2006 that allowed them to capture card data as it traveled over the network in the clear. TJX failed to detect the sniffer for seven months and also failed to notice that the intruders siphoned 80 gigabytes of stored data from a TJX server and transferred it over TJX's own high-speed connection to another location.
The papers also revealed that in 2004, before the thieves began their initial intrusion in 2005, an audit of TJX's network found "high-level deficiencies" in its security practices. The company was found to be non-compliant with 9 of 12 requirements established by the payment card industry for secure card transactions. The problems included a misconfigured wireless network, improper anti-virus protection, weak intrusion-detection, use of user names and passwords that were easily cracked, and improper patch procedures and log maintenance.
No comments:
Post a Comment