45.7 Million Credit Card Numbers Stolen

45.7 Million Credit Card Numbers Stolen

news.yahoo.com

A hacker or hackers stole data from at least 45.7 million credit and debit cards of shoppers at off-price retailers including T.J. Maxx and Marshalls in a case believed to be the largest such breach of consumer information.

For the first time since disclosing the theft more than two months ago, the parent company of nearly 2,500 discount stores put a number on how much card data was compromised — and it's a number TJX Cos. acknowledges could go still higher.

(visit the link for the full news article)

This is just crazy, I can't believe this data was kept in such a way that hackers could get to it. If there are 300 million Americans then its like 1 in 6 Americans Credit Card Numbers are now in the hands of scam artists. Not to mention that they have known this for a while now and are just now letting the world know? Someone needs to be held accountable for this one!

~Anathema

news.yahoo.com
(visit the link for the full news article)

Almost all data is kept in such a way that hackers can get at it. Unless a system is off the network, it can be hacked. It's only a matter of time and motivation.

I wouldn't really call them scam artists, either. They'll just sell the numbers to someone else. They haven't really scammed anything.

Unless there was a deliberate act of negligence on the part of their network security ninjas, I don't see how they can be held legally liable for the damages. The only ones to be held accountable are the hackers.

I'd call them scam artist, con artist, thieves, or whatever.... all the same to me as far as this story goes. They stole 45+ million credit card infos and are gonna either sell hem or use them, all of which are very bad.

Also if all data is kept in a way that it can be hacked then what does that say about the security in our country? Diddly squat. Also there are steps that can be taken to safe guard information. More often then not incedents such as this could have been adverted if a little effort was put into protecting the data.

I don't think if these people had to answer to a higher authority that your statement of the credit card info is basically impossible to protect would not hold water. Thats just the excuse of lazy people who want to pass the buck.

~Anathema

Just saw this on the Wayne Maradsen Report:

Personal Data Thefts 2005-2007:



waynemadsenreport.com...

Lists the companies, the type of data and the numbers. Mind boggling.


TIA is also mentioned.

Just a few days after it was discovered that the Total Information Awareness surveillance system is alive and well under a Singapore identity comes word from the Securities and Exchange Commission (SEC) that the following number of hacking victims we reported in December as being in the "millions" now has been reported by TJX Corporation to the SEC as 45.7 million credit and debit card customers:

[edit on 29-3-2007 by deessell]

Originally posted by deessell
Lists the companies, the type of data and the numbers. Mind boggling.

You hit the nail right on the head with that statement buddy, mind boggling!

It is unbelieveable that we are just supposed to be like "oh well its data and data can't be protected so try harder next time people who are supposed to protect our information."

Yeah right, someone needs to be heald accountable for this.

~Anathema

Originally posted by anathema777
I don't think if these people had to answer to a higher authority that your statement of the credit card info is basically impossible to protect would not hold water. Thats just the excuse of lazy people who want to pass the buck.

You can make data very very difficult to access. That is all that is possible. This is not an excuse. It is reality.

It's the same as protecting your car from theft. If someone wants it bad enough, they're going to get it. All you can do is slow them down.

Originally posted by anathema777
Not to mention that they have known this for a while now and are just now letting the world know? Someone needs to be held accountable for this one!

They did let the world know over two months ago. Here is a technology blog discussing the breach.

Credit card companies have been working on this since it was discovered. My wife's card was flagged for fraud and then a new one reissued over a month ago. There may have been a gag order in place because at the time, Citibank wouldn't say who the company was, only that they had been in the news recently.

Yes, security is weak in many networks. Being an IT person I can state that without a doubt. I'll also agree with the article above that it can take time to discover a breach. Let's face it, not many companies pay someone to constantly monitor security logs. Plus, until there is a pattern of fraudulent spending that can point to a common denominator, it takes time to identify the source of the credit card numbers.

This is not a defense for TJMaxx; but a little insight into what the problem is. Technology magazines have been saying for years that companies don't invest in two things until something happens. Those two things are disaster recovery and intrusion detection. It goes without saying that failure to keep up to date on system patches can leave a gaping hole in your network. Welcome to the world of IT management where cost versus value is often measured in tangible potential savings versus the cost of a loss or breach. I struggle with it all the time at clients and employers.

Originally posted by apc

Originally posted by anathema777
I don't think if these people had to answer to a higher authority that your statement of the credit card info is basically impossible to protect would not hold water. Thats just the excuse of lazy people who want to pass the buck.

You can make data very very difficult to access. That is all that is possible. This is not an excuse. It is reality.

It's the same as protecting your car from theft. If someone wants it bad enough, they're going to get it. All you can do is slow them down.

Again this is not acceptable for me one bit. They need to restructure thier system and use some kind of encryption so the data is useless if stolen. If data can't be protected then they MUST redo the system so that data isn't available, period.

~Anathema

You desperately need this.

And a whole lot more.

Somehow I don't think so, and that's without seeing the link that you posted, which doesn't work I might add.

I'm moving on to some other threads I need to put my attention into now. Just wanted to post this news story so that you ATS'ers who are interested in knowing about the huge security flaws our economic system has set up. It really is too bad that this stuff has to happen and millions if not billions of dollars have to be stolen before someone wakes up and rethinks things. This whole data can't be protected argument is simply stupid. That's all there is to it. If the data is able to be compromised so easily then they need to start using biometrics for shopping or banking so that the "data" is useless without other security proceedures to help verify.

Data can be protected. This can be done by simply making it so that data alone cannot be used to accomplish whatever mission a crook is trying to do. All they need do is add more features like they did with the CCV code. It would seem a few people need to have their identity stolen from them before they change their attitude from "nothing can be done about it so just cross your fingers", too "Something needs to be done about this because 45 million stolen credit card numbers is NOT acceptable".

Later

~Anathema

[edit on 3/29/2007 by anathema777]