TJX, PCI Compliance Update

According to Storefront Backtalk, attorneys suing TJX about its data breach have cited new information from the clothing retail chain to amend their complaints on Thursday and want a jury to evaluate TJX's security professionalism.

- New details that emerged from documents filed in federal court Thursday indicate that a TJX consultant found that not only was TJX not PCI-compliant, but that it had failed to comply with nine of the 12 applicable PCI requirements. Many were "high-level deficiencies," the consultant said.
- "After locating the stored data on the TJX servers, the intruder used the TJX high-speed connection in Massachusetts to transfer this data to another site on the Internet" in California. More than "80 GBytes of stored data improperly retained by TJX was transferred in this manner. TJX did not detect this transfer."
- In May 2006, a traffic capture/sniffer program was installed on the TJX network by the cyber thieves, where it remained undetected for seven months, "capturing sensitive cardholder data as it was transmitted in the clear by TJX."
- In 2004, before the attacks began, TJX was issued a report on its security compliance that "identified numerous serious deficiencies at TJX, including specific violations. TJX did not remedy many of these definciences.
- At his deposition, the unnamed TJX consultant said that "he had never seen such a void of monitoring and capturing via logs activity at a Level One merchant as he saw at TJX."
- "The data breach at TJX affected more than 100 million separate and distinct credit and debit card account numbers, more than twice the size of the next largest data breach in the history of the country."
# The filings confirmed that both Visa and MasterCard have fined TJX. Visa issued "a substantial fine" in connection with the TJX data breach, dubbing it an "egregious violation" of security procedures. The sizes of the fines were not specified.

The filings for the first time also listed the key security problems that a TJX consultant found: improperly configuring its wireless network; not segmenting cardholder data devices from the rest of network traffic; "TJX did not have an IT department that was properly tasked to manage the environment used to store, process or transmit cardholder data;" improperly storing prohibited cardholder data; using usernames and passwords "that were easy to penetrate;" improper patch procedures; logs not properly maintained; antivirus protection "improper;" and weak intrusion detection.

Thursday's revised complaint linked the bad security practices with the computer breach, which forces banks to take expensive actions to defend themselves. One key issue in civil cases such as this is whether the defendant can be shown to be simply careless or deliberately reckless. That distinction relies on showing what was likely in the defendant's mind at the time of the acts that lead to the data breach.

Attorneys for the banks indicated they would try to show that intent with internal TJX documents obtained during discovery. "TJX knew —- and discussed internally prior to the breach —- that its deficiencies in network and data security could lead to the exact losses incurred here in the many millions of dollars," said the filing, "and that had TJX properly disclosed information about the extent of its noncompliance with network security requirements prior to the breach, then actions to correct the deficiencies and prevent the breach could have been taken."

On a related matter, Visa on Wednesday reported that some 65 percent of the nation's largest retailers are now compliant with the industry standard Payment Card Industry Data Security Standard (PCI). That means that that 35 percent -— more than one out of every three —- large retailers today are still not PCI-compliant, despite the passing of the Sept. 30 deadline and the start of the promised $25,000/month fines for non-compliance.

On a potentially even more scary note, Visa reported that PCI compliance among the more numerous Level 2 retailers —- who process between one million and six million Visa transactions a year —- is only at 43 percent, as of Sept. 30, 2007.

However, Visa did say that 99 percent of Level 1 and Level 2 retailers "confirmed they are not storing prohibited account data such as magnetic stripe -- also known as track data -- CVV2 (the security code on the back of the card) and PIN data." That's up from the 96 percent that Visa reported in July. Those sets of prohibited data are seen as especially attractive to data thieves.