Fri, Jan 23rd 2009 1:51pm
Until earlier this week, TJX held the record for the biggest-ever data leak, for its effort to lose track of some 94 million people's credit card info to a group of hackers. Just to recap, the company lost all the data largely through sheer incompetence, by encrypting its stores' WiFi networks with the easily broken WEP standard, and not having enough security in place to keep the hackers out of its central database after they'd gotten on the network at a single store. Even more astounding was the fact that TJX transmitted credit-card info to banks without any encryption. It was the banks that were largely left holding the bag for all the fraudulent purchases made with the stolen credit-card numbers, while several of the criminals behind the breach were charged, too. What punitive action was taken against TJX? It had to pay a $41 million fine to Visa, but got off with no fine and a wrist slap from the Federal Trade Commission. But apparently the company really wanted to make things up to consumers, so it offered a one-day 15 percent off sale in its US and Canadian stores this week. Wow, so generous, especially to do it in the post-holiday, lets-clear-out-everything-we-didn't-sell-before-Christmas season. You could probably forgive TJX for thinking this would make up for everything, though, since data-leak settlements and punishments are generally toothless and do little to encourage companies to take serious steps to stop the leaks.
If you liked this post, you may also be interested in...
- T-Mobile Customer Data Leaked By Experian... And Faulty Encryption Implementation
- CIA, FBI And Much Of US Military Aren't Doing The Most Basic Things To Encrypt Email
- Why Backdoors Always Suck: The TSA Travel Locks Were Hacked And The TSA Doesn't Care
- The Story Behind The Hackers Behind The Largest Credit Card Number Heist
- Looks Like The Guy Who Set The Record For Largest Credit Card Breach Was Breaking His Own Record