<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories filed under &quot;breach&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories filed under &quot;breach&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Tue, 6 Nov 2012 07:44:40 PST</pubDate>
<title>Epic's 'Music First' Approach: Delay Album Release; Drop Band When They Leak It</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20121105/07291120932/epics-music-first-approach-delay-album-release-drop-band-when-they-leak-it.shtml</link>
<guid>http://www.techdirt.com/articles/20121105/07291120932/epics-music-first-approach-delay-album-release-drop-band-when-they-leak-it.shtml</guid>
<description><![CDATA[ Last month, we wrote about how the band Death Grips, an indie sensation who had signed with Epic Records (owned by Sony Music), had decided to <a href="http://www.techdirt.com/articles/20121001/19120320564/band-gives-away-latest-album-after-label-attempts-to-shelve-it-until-sometime-next-year.shtml">release</a> their latest album for free all over the internet, after some sort of dispute with Epic over the release date.  The band was already considered one of the <a href="http://www.techdirt.com/articles/20120928/23265120546/yes-there-are-many-many-many-many-legal-uses-bittorrent.shtml">top authorized downloaded bands</a> on BitTorrent due to earlier releases it had put online for free itself.  However, with Epic trying to take a standard "slow down and wait" approach, the band posted its new album to various file lockers and started tweeting out links, noting that "the label will be hearing the album for the first time with you."
<br /><br />
Last week, the band <a href="https://www.facebook.com/photo.php?fbid=474002185978299&#038;set=a.176170062428181.39239.170869886291532&#038;type=1&#038;permPage=1" target="_blank">posted a screenshot</a> of an irate email from the label about this. Epic notes not only that is it absolutely furious about the leak, but that (1) the release is a breach of contract; (2) since Epic owns the copyright, the label considers the leak to be infringing; (3) the band's decisions have "financially damaged Epic"; (4) even though Epic still intended to release the album, <b>the album would not count towards the recording commitment</b> in the band's contract and (5) while Epic still intended to collect money for the sale of the album (which, again, would not count towards the recording commitment), Epic would not cover the cost of recording the album.
<center>
<a href="http://imgur.com/fm3dX"><img src="http://i.imgur.com/fm3dX.png" width=560 /></a>
</center>
Those last two points are the really interesting ones to me.  If it's not counting the album towards the recording commitment, and it now refuses to pay for the cost of the album, it seems wrong to then still consider it something that Epic gets to sell and to keep all the revenue from.
<br /><br />
Either way, it appears that won't be an issue, because just a few weeks after that email was sent, Epic officially <a href="http://pitchfork.com/news/48448-epic-records-drops-death-grips/" target="_blank">began the process of dropping Death Grips</a> from the contract.  This probably won't surprise many people, though it will be interesting to see if Epic retains "ownership" of the work in question or if Death Grips is able to get back control of its masters.  That said, Epic's "statement" about this move is absolutely hilarious for being obviously, blatantly, false:
<blockquote><i>
Epic Records is a music first company that breaks new artists. That is our mission and our mandate. Unfortunately, when marketing and publicity stunts trump the actual music, we must remind ourselves of our core values. To that end, effective immediately, we are working to dissolve our relationship with Death Grips. We wish them well.
</i></blockquote>
First of all, Death Grips had already "broken" without Epic's help.  Second, since when has a major label ever really cared about "the actual music" as compared to the ability to make money off of it with marketing and publicity stunts?  And, really, if it were just about "the music," then why would it have freaked out so much when the band made "the music" available for free?<br /><br /><a href="http://www.techdirt.com/articles/20121105/07291120932/epics-music-first-approach-delay-album-release-drop-band-when-they-leak-it.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20121105/07291120932/epics-music-first-approach-delay-album-release-drop-band-when-they-leak-it.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20121105/07291120932/epics-music-first-approach-delay-album-release-drop-band-when-they-leak-it.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>uh-what?</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20121105/07291120932</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 17 May 2011 19:07:00 PDT</pubDate>
<title>France Suspends 3 Strikes Monitoring Following Data Breach</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110517/02075514296/france-suspends-3-strikes-monitoring-following-data-breach.shtml</link>
<guid>http://www.techdirt.com/articles/20110517/02075514296/france-suspends-3-strikes-monitoring-following-data-breach.shtml</guid>
<description><![CDATA[ Over the weekend, TorrentFreak reported that the company that French "three strikes and you're off the internet" agency Hadopi had hired to help it track down infringers, Trident Media Guard, <a href="http://torrentfreak.com/french-hadopi-3-strikes-anti-piracy-company-hacked-110514/" target="_blank">had been hacked</a>, though, in reality it appears to be much more of a simple data breach caused by TMG poor setup.  The breach left open a lot of details of the tracking system, including IP addresses linked to the whole 3 strikes process.  In response, it appears that Hadopi has <a href="http://torrentfreak.com/french-3-strikes-suspended-due-to-anti-piracy-security-alert-110517/" target="_blank">"temporarily suspended" its work with TMG</a>, perhaps to measure the damage and see if it can actually learn to lock down its computers.  In the meantime, however, as TorrentFreak points out, there are no other providers doing this monitoring -- meaning that (at least for a little while), it appears 3 strikes monitoring has stopped in France.<br /><br /><a href="http://www.techdirt.com/articles/20110517/02075514296/france-suspends-3-strikes-monitoring-following-data-breach.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110517/02075514296/france-suspends-3-strikes-monitoring-following-data-breach.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110517/02075514296/france-suspends-3-strikes-monitoring-following-data-breach.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>oops</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110517/02075514296</wfw:commentRss>
</item>
<item>
<pubDate>Wed, 4 May 2011 12:02:00 PDT</pubDate>
<title>Sony Blames Anonymous For Latest Hack...</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110504/11175714141/sony-blames-anonymous-latest-hack.shtml</link>
<guid>http://www.techdirt.com/articles/20110504/11175714141/sony-blames-anonymous-latest-hack.shtml</guid>
<description><![CDATA[ Apparently Sony has decided to pick on an easy target for its <a href="http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml">latest data breach</a>: Anonymous.   Sony is claiming it <a href="http://thehill.com/blogs/hillicon-valley/technology/159233-sony-blames-hacker-group-anonymous-for-latest-attack?utm_campaign=HilliconValley&#038;utm_source=twitterfeed&#038;utm_medium=twitter" target="_blank">found a file named "Anonymous" on the server</a>, with the non-group's phrase "We are Legion" in the file:
<blockquote><i>
"The attacks were coordinated against Sony for exercising its rights in a civil action in the United States District Court in San Francisco against a hacker," Sony chairman Kazuo Hirai said in the letter.
<br /><br />
"What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes."
</i></blockquote>
Of course, those two sentences don't seem to match.  Anonymous isn't known (at all) for trying to steal credit card information for criminal purposes.  Its entire purpose is more along the lines of vigilante protests.  Also, Anonymous may be the easiest "group" in the world to frame.  Because it's not a group and anyone and everyone can be a part of it, you just put a file named "Anonymous" somewhere along with the phrase "We are Legion" and clueless dupes assume it was "the" Anonymous rather than a bunch of organized crime hackers searching for credit card details.  It very well could have been an Anonymous operation, but it seems like Sony should have a bit more proof before making such a definitive statement on the matter.<br /><br /><a href="http://www.techdirt.com/articles/20110504/11175714141/sony-blames-anonymous-latest-hack.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110504/11175714141/sony-blames-anonymous-latest-hack.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110504/11175714141/sony-blames-anonymous-latest-hack.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>easiest-framing-ever</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110504/11175714141</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 3 May 2011 06:57:56 PDT</pubDate>
<title>Things Get Worse And Worse For Sony As Another Massive Data Breach Detected</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml</link>
<guid>http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml</guid>
<description><![CDATA[ For the few of you left who still trusted Sony, now comes news of <a href="http://www.wired.com/gamelife/2011/05/sony-online-entertainment-hack/?utm_source=feedburner&#038;utm_medium=feed&#038;utm_campaign=Feed%3A wired%2Findex %28Wired%3A Index 3 %28Top Stories 2%29%29" target="_blank">yet another massive data breach</a>, this time for Sony Online Entertainment (SOE) users.  SOE is their online multiplayer games offering.  It sounds like a similar issue to the PSN hack, again with lots of data being taken.  Making matters worse, apparently for players outside the US, Sony kept credit card numbers and/or bank details in an "outdated database" (read, one not properly secured or encrypted, apparently).  And... Sony is now admitting that the breach occurred a few weeks ago, so this info has probably already been put to use.  So, we've got the rootkit, the PSN and now the SOE issue.  Who actually willingly pays Sony for anything any more?<br /><br /><a href="http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110502/23490314123/things-get-worse-worse-sony-as-another-massive-data-breach-detected.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>this-is-why-you-don't-trust-rootkitters</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110502/23490314123</wfw:commentRss>
</item>
<item>
<pubDate>Fri, 5 Nov 2010 03:28:56 PDT</pubDate>
<title>If You Discover A Privacy Data Breach, You Probably Shouldn't Wait Three Months To Tell Users</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20101103/22495711713/if-you-discover-a-privacy-data-breach-you-probably-shouldn-t-wait-three-months-to-tell-users.shtml</link>
<guid>http://www.techdirt.com/articles/20101103/22495711713/if-you-discover-a-privacy-data-breach-you-probably-shouldn-t-wait-three-months-to-tell-users.shtml</guid>
<description><![CDATA[ Insurance firm Wellpoint apparently left its medical records easily exposed on its servers from last October until March, exposing 470,000 users' medical records, credit card numbers and "other sensitive info."  The company discovered the breach in February, but apparently <a href="http://www.businessweek.com/ap/financialnews/D9J5JNK00.htm" target="_blank">waited until June to tell users</a>.  The company has now been fined $300,000 for not promptly notifying users, though that does seem like a rather low number considering how many records were apparently exposed...<br /><br /><a href="http://www.techdirt.com/articles/20101103/22495711713/if-you-discover-a-privacy-data-breach-you-probably-shouldn-t-wait-three-months-to-tell-users.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20101103/22495711713/if-you-discover-a-privacy-data-breach-you-probably-shouldn-t-wait-three-months-to-tell-users.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20101103/22495711713/if-you-discover-a-privacy-data-breach-you-probably-shouldn-t-wait-three-months-to-tell-users.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>fined</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20101103/22495711713</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 12 Aug 2010 16:31:13 PDT</pubDate>
<title>Company That Had The Largest Ever Credit Card Data Breach... Apparently Breached Again [Update]</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20100812/15223610610.shtml</link>
<guid>http://www.techdirt.com/articles/20100812/15223610610.shtml</guid>
<description><![CDATA[ Remember Heartland Payment Systems?  It's the giant credit card clearinghouse that was involved in the <a href="http://www.techdirt.com/articles/20090120/1450363464.shtml">largest ever security breach</a> in terms of the number of credit card numbers exposed.  They were successfully targeted by the <A href="http://www.techdirt.com/articles/20100521/1053599529.shtml">same guys</a> who had also <a href="http://www.techdirt.com/articles/20090818/0047085910.shtml">set the previous record</a> for largest credit card data breach, so you could question whether the issue was just a sophisticated group of hackers or poor security at Heartland (or, possibly, a combination of both).  Either way, it looks like Heartland may still have some issues.  Carlo sends over the news that <a href="http://www.statesman.com/blogs/content/shared-gen/blogs/austin/blotter/entries/2010/08/12/security_breach_affecting_cred.html?cxntfid=blogs_the_blotter" target="_blank">a new security breach has been discovered at a restaurant in Austin, Texas</a> that appears to involve someone hacking into the network between the restaurant and Heartland.  It's not yet clear if this goes beyond that one restaurant, but this can't look good for Heartland.
<br><br>
<b>Update</b>: Heartland got in touch to let us know that this appears to be an issue outside of Heartland's system, and that Heartland is not the target of the investigation into the breach.  Heartland's press release is basically pointing out that the weakness was with the restaurant's credit card security, not its own.<br /><br /><a href="http://www.techdirt.com/articles/20100812/15223610610.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20100812/15223610610.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20100812/15223610610.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>hits-you-in-the-heartland</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20100812/15223610610</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 15 Jun 2010 20:35:10 PDT</pubDate>
<title>Could AT&#038;T's iPad Email Leak Really Be A Much, Much More Serious Security Breach?</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20100615/0042179819.shtml</link>
<guid>http://www.techdirt.com/articles/20100615/0042179819.shtml</guid>
<description><![CDATA[ Last week, we wrote about the <a href="http://www.techdirt.com/articles/20100609/1604379757.shtml">security glitch</a> by AT&#038;T, that allowed hackers to figure out the email addresses of 114,000 iPad users.  A few people in the comments mocked this news, claiming that such info was pretty much meaningless, as email addresses are hardly private info these days.  Of course, that ignored the connection of the email address to the fact that you bought an iPad.  But now, some are realizing the potential security problems with this may be significantly worse.  <a href="http://mobile.slashdot.org/story/10/06/14/210205/ATampT-Breach-May-Be-Worse-Than-Initially-Thought?from=twitter" target="_blank">Slashdot</a> point us to a story where someone walks through how poor security choices by the various mobile operators means that knowing the information revealed by the glitch <a href="http://www.tombom.co.uk/blog/?p=166" target="_blank">can actually reveal much, much more</a>.  As the blog post walks through the details, it concludes that <i>potentially</i>, the data from the breach in some cases (though, not all) could then be used to figure out a lot more:
<blockquote><i>
So yeah, knowing someone's ICCID can give you their full unpublished billing name, their cellular phone number (and hence their home address), their current location on a realtime basis, their voicemail, and if you're prepared to follow them around (within a few miles) then you get all their phone calls and SMS messages too.
</i></blockquote>
There is a later edit, when he realizes that the voicemail/phone calls/SMS stuff might not be that big of a deal, since the iPad is not a phone device, but it's still instructive of how a "simple" data breach can lead to much more in certain circumstances.<br /><br /><a href="http://www.techdirt.com/articles/20100615/0042179819.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20100615/0042179819.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20100615/0042179819.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>doesn't-sound-good</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20100615/0042179819</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 10 Jun 2010 01:05:26 PDT</pubDate>
<title>Script Kiddie Botnet Operators Ask For Jobs From Security Company That Shut Them Down</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20100607/0109289707.shtml</link>
<guid>http://www.techdirt.com/articles/20100607/0109289707.shtml</guid>
<description><![CDATA[ The BBC has a story about how the operators of one of the larger botnets that was recently shut down <a href="http://news.bbc.co.uk/2/hi/technology/10240117.stm" target="_blank">showed up at the offices of a security researcher who helped bring them down</a>... asking for a job.  The article highlights how the researcher, Luis Corrons, basically had figured out who was running the botnet after one of the operators made a mistake and revealed his home computer... which actually was not far from where Corrons worked.  It was shut down at the end of last year, but a few months later, Corrons had an interesting experience:
<blockquote><i>
In late March Mr Corrons was preparing for a meeting at Panda's Bilbao lab with a journalist and took a moment to dodge downstairs to get a drink. On the way down he passed two young men coming up.
<br /><br />
One asked if he was Luis Corrons. He said yes while wondering who they were.
<br /><br />
They introduced themselves which left him no wiser. Then, one of them said; "I'm Ostiator and this is Netkairo."
<br /><br />
"It was then I realised these guys were the ones that were arrested in the Mariposa case," he told the BBC. "I thought they wanted to teach me a lesson." 
</i></blockquote>
Instead, they asked him for a job, saying that the shutdown of the botnet had "robbed them of their livelihood."  Apparently, the two guys started following Corrons on Twitter, sending messages his way and commenting on his blog, before asking for work again.  They finally brought in one of the guys for an interview, noting that they wouldn't hire anyone involved in criminal activity.  The guy responded that he hadn't been charged with anything.  However, Corrons also quickly realized that the guy barely had any technical skills -- pointing out that he didn't write the bot, he just ran it:
<blockquote><i>"He got really annoyed at that moment, when we told him he was not good enough," said Mr Corrons. Subsequent discussion revealed just how poor their skills were.
<br /><br />
"They were given the botnet with all the stuff they needed," said Mr Corrons. "Using it was like using any other program."
</i></blockquote>
So, for the script kiddies out there, perhaps before asking for a job from the security researchers who bring your botnet down, you do a bit of work to make sure you have the actual skills.<br /><br /><a href="http://www.techdirt.com/articles/20100607/0109289707.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20100607/0109289707.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20100607/0109289707.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>didn't-work</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20100607/0109289707</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 7 Jun 2010 02:26:51 PDT</pubDate>
<title>Once Again, Court Says If There's No Real Harm, There's No Legal Recourse For Privacy Breach</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20100604/1533169700.shtml</link>
<guid>http://www.techdirt.com/articles/20100604/1533169700.shtml</guid>
<description><![CDATA[ Way back in 2006, we noted a series of cases where people had brought lawsuits over claimed "privacy" breaches, involving lost or leaked data, where the courts repeatedly ruled that if there was no evidence that the leaked data was used for nefarious purposes, <a href="http://www.techdirt.com/articles/20061019/101559.shtml">there was no case</a>.  Odd that this applies to things like privacy, but when you see a similar situation with copyright, no one ever has to show any actual harm.  Either way, it looks like courts are continuing to follow this particular line of thought, as <a href="http://blog.ericgoldman.org/archives/2010/06/9th_circuit_aff.htm" target="_blank">a lawsuit against Gap for losing private data has been rejected</a> under the same line of thinking.  This also almost certainly means that all those <a href="http://www.techdirt.com/articles/20100520/0101169502.shtml">class action</a> lawsuits against Google for possibly collecting some WiFi data, are completely dead in the water.  In those cases, the plaintiffs don't even show any evidence that their data was collected, let alone give any proof of harm.<br /><br /><a href="http://www.techdirt.com/articles/20100604/1533169700.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20100604/1533169700.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20100604/1533169700.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>why-doesn't-that-apply-elsewhere?</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20100604/1533169700</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 18 Aug 2009 05:42:47 PDT</pubDate>
<title>Looks Like The Guy Who Set The Record For Largest Credit Card Breach Was Breaking His Own Record</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20090818/0047085910.shtml</link>
<guid>http://www.techdirt.com/articles/20090818/0047085910.shtml</guid>
<description><![CDATA[ Back in January, we noted that it looked like there might be a <a href="http://www.techdirt.com/articles/20090120/1450363464.shtml">new winner</a> in the battle to see who was responsible for the largest ever credit card breach.  Until that time, the honor had gone to a series of department stores owned by TJX (TJ Maxx, Marshalls, etc.).  That involved info on 94 million credit card holders.  Not bad.  But the newer deal, involving Heartland Payment Systems appeared to effect well over 100 million.  Now, you may have seen the news reports this week that have upped that total to 130 million, as part of the announcement of <a href="http://news.bbc.co.uk/2/hi/americas/8206305.stm" target="_new">indictments against three individuals for illegally accessing the data</a>.  But, what's fascinating is that the one guy in custody, Albert Gonzalez, <a href="http://www.washingtonpost.com/wp-dyn/content/article/2009/08/17/AR2009081701915.html?wprss=rss_technology" target="_new">was already in custody for his role in the TJX hack</a> (along with some other retailers).  Oh, and there's also the tidbit about how he was a government informant, handing over info on (you guessed it) the underworld involved in stolen credit card numbers.<br /><br /><a href="http://www.techdirt.com/articles/20090818/0047085910.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20090818/0047085910.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20090818/0047085910.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>raising-the-bar</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20090818/0047085910</wfw:commentRss>
</item>
<item>
<pubDate>Fri, 23 Jan 2009 13:51:05 PST</pubDate>
<title>TJX Offers One-Day Sale To Make Up For Massive Data Breach</title>
<dc:creator>Carlo Longino</dc:creator>
<link>http://www.techdirt.com/articles/20090123/1055363506.shtml</link>
<guid>http://www.techdirt.com/articles/20090123/1055363506.shtml</guid>
<description><![CDATA[ Until <a href="http://techdirt.com/articles/20090120/1450363464.shtml">earlier</a> this week, TJX held the record for the <a href="http://techdirt.com/articles/20090120/1450363464.shtml">biggest-ever</a> data leak, for its effort to lose track of some 94 million people's credit card info to a group of hackers. Just to recap, the company lost all the data largely through <a href="http://www.techdirt.com/articles/20070504/114216.shtml">sheer incompetence</a>, by encrypting its stores' WiFi networks with the easily broken WEP standard, and not having enough security in place to keep the hackers out of its central database after they'd gotten on the network at a single store. Even more astounding was the fact that TJX transmitted credit-card info to banks without any encryption. It was the banks that were largely left holding the bag for all the fraudulent purchases made with the stolen credit-card numbers, while several of the criminals behind the breach <a href="http://techdirt.com/articles/20080806/0022511903.shtml">were charged</a>, too. What punitive action was taken against TJX? It had to pay a <a href="http://www.usatoday.com/money/industries/retail/2007-11-30-tjx-visa-breach-settlement_N.htm">$41 million fine</a> to Visa, but got off with no fine and a <a href="http://www.networkworld.com/community/node/26411">wrist slap</a> from the Federal Trade Commission. But apparently the company really wanted to make things up to consumers, so it offered <a href="http://www.theregister.co.uk/2009/01/23/tjx_sale/" target="_new">a one-day 15 percent off sale</a> in its US and Canadian stores this week. Wow, so generous, especially to do it in the post-holiday, lets-clear-out-everything-we-didn't-sell-before-Christmas season. You could probably forgive TJX for thinking this would make up for everything, though, since data-leak settlements and punishments are generally <a href="http://techdirt.com/articles/20070925/113835.shtml">toothless</a> and do little to encourage companies to take serious steps to stop the leaks.<br /><br /><a href="http://www.techdirt.com/articles/20090123/1055363506.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20090123/1055363506.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20090123/1055363506.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>how-generous</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20090123/1055363506</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 6 Dec 2007 00:43:27 PST</pubDate>
<title>Canadian Passport Website Falls For Oldest Privacy Breach On The Web</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20071205/190901.shtml</link>
<guid>http://www.techdirt.com/articles/20071205/190901.shtml</guid>
<description><![CDATA[ Back in the early days of the web, there were plenty of stories about a rather simple security breach on various sites.  Basically, many sites would simply pass a user's account number through as a part of the URL.  If a user simply changed the URL, her or she could see the account info of that other issue associated with the new number.  After a few such cases came to light, most web app designers quickly realized to plug that hole, and it's been quite some time since we've heard of a site with such a security hole.  However, it appears that there are still a few.  The site for Passport Canada, where people can apply for a Canadian passport apparently <a href="http://www.theglobeandmail.com/servlet/story/RTGAM.20071204.wpassport1204/BNStory/National/home">had exactly that security vulnerability</a>, allowing the guy who discovered it to see the passport application data of other applicants simply by adjusting the URL.  It's never nice to hear about a security flaw (especially on a gov't website with all sorts of private info), but it actually induces a bit of nostalgia to hear of such a basic security flaw showing up in the wild yet again.<br /><br /><a href="http://www.techdirt.com/articles/20071205/190901.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20071205/190901.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20071205/190901.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>that-one-again?</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20071205/190901</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 29 Oct 2007 18:19:10 PDT</pubDate>
<title>Remember How TJX Was The Worst Data Breach In History?  Well, It Was Actually Worse</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20071026/172147.shtml</link>
<guid>http://www.techdirt.com/articles/20071026/172147.shtml</guid>
<description><![CDATA[ In the last few years, every time a massive data breach is reported, you can be assured of one thing: a few weeks after the initial report comes out, a second report will come out admitting that the breach was <a href="http://techdirt.com/articles/20070214/064307.shtml">worse</a> than previously expected.  We saw it with <a href="http://www.techdirt.com/articles/20050218/1534206.shtml">Choicepoint</a>.  We saw it with the <a href="http://techdirt.com/articles/20070214/064307.shtml">VA</a>.  It seems to always happen.  In fact, with the now infamous <a href="http://www.techdirt.com/articles/20070119/090325.shtml">TJX breach</a>, we'd already mentioned that the problems were <a href="http://www.techdirt.com/articles/20070221/121129.shtml">worse</a> than originally announced -- making it the largest such breach ever reported.  This wasn't surprising once you found out just how <a href="http://www.techdirt.com/articles/20070504/114216.shtml">incompetent</a> the company was -- failing to comply with nearly all of the credit card company's security guidelines and leaving their entire system wide open to anyone who could hack a simple insecure WEP WiFi system (something that's quite easily done).  The data from the breach (unlike many other widely announced breaches) has already been used in numerous frauds, costing upwards of $60 million.  With such astounding incompetence and a breach so large, should it come as any surprise that even the updated breach numbers weren't complete?  That's right, thanks to documents being filed in the lawsuits against TJX, it's now coming out that the <a href="http://www.securityfocus.com/news/11493?ref=rss">breach has impacted even more people</a> than was earlier announced.  Of course, the question still remains whether or not the punishment the company receives will matter.  It doesn't seem like anything is really done to stop companies from being so careless, and there's no indication that's going to change in this case either.<br /><br /><a href="http://www.techdirt.com/articles/20071026/172147.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20071026/172147.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20071026/172147.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>stunning-incompetence</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20071026/172147</wfw:commentRss>
</item>
<item>
<pubDate>Fri, 13 Jul 2007 10:39:00 PDT</pubDate>
<title>More People Busted With Credit-Card Numbers From TJX Breach</title>
<dc:creator>Carlo Longino</dc:creator>
<link>http://www.techdirt.com/articles/20070712/204012.shtml</link>
<guid>http://www.techdirt.com/articles/20070712/204012.shtml</guid>
<description><![CDATA[ The Secret Service has busted four people in Florida, and recovered <a href="http://www.informationweek.com/security/showArticle.jhtml?articleID=201001100&#038;cid=RSSfeed_TechWeb">200,000 credit cards from the TJX breach</a> that was disclosed <a href="http://www.techdirt.com/articles/20070119/090325.shtml">earlier this year</a>. Recovering the credit-card numbers at this point does little more than link the fraudsters to the breach, but they're said to have been used to rack up more than $75 million in fraudulent charges. The people busted here didn't apparently participate in the theft of the credit-card data, but bought them from "known cybercriminals in Eastern Europe" and then used the numbers to make counterfeit cards. In any case, they're way more productive than another group of Florida scammers busted back in March, who only managed to rack up <a href="http://www.techdirt.com/articles/20070321/201456.shtml">$8 million worth of goods</a> at Sam's and Wal-Mart. Since banks get left holding the bag for this type of fraud, expect <a href="http://www.techdirt.com/articles/20070425/071257.shtml">more lawsuits</a> as they look to recover their losses from TJX's astounding level of <a href="http://www.techdirt.com/articles/20070504/114216.shtml">incompetence</a>.<br /><br /><a href="http://www.techdirt.com/articles/20070712/204012.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20070712/204012.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20070712/204012.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>cha-ching</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20070712/204012</wfw:commentRss>
</item>
</channel>
</rss>