Dark Reading

Since TJX Companies disclosed its massive data breach back in January, hackers, security pros, banks, and victims have all been asking one common question: Exactly how did it happen? (See TJX Breach Skewers Customers, Banks.)

Officially, TJX still isn't telling. But Canadian government investigators this morning issued a report on their findings, which were derived from a nine-month study that received the retail giant's cooperation. The report confirms some earlier news reports, while contradicting others.

The Canadian government investigation confirms that the attackers gained access to TJX data via wireless LANs at two retail stores over a period of many months. The attackers gained access to the data through two Marshall's stores in the Miami area -- not in Minnesota or Massachusetts, as previously reported, officials said.

The wireless LANs were secured only by Wired Equivalent Privacy (WEP), a technology that has been known to be vulnerable for more than a year.

The criminals used the wireless connection to access TJX's Retail Transaction Switch servers, which store information about customer transactions throughout North America. Investigators suspect that the data was collected via some sort of malware, but that the attackers have implemented some method of deleting, removing, or obfuscating the malware, which has made the exact method of attack difficult to pinpoint -- and the criminals impossible to find.

Canadian officials declined to give details on how the tapping of the wireless connections occurred, for fear of giving other hackers ideas on how to do it.

Not surprisingly, the report concludes that TJX did not take sufficient steps to secure or dispose of the sensitive data. The company's upgrade from WEP to WPA took too long, and sufficient encryption was not put in place, it says.

The report also says TJX did not do enough to monitor its systems. The risk of a breach "was foreseeable," the report says, and the company should have been aware of the attack prior to its discovery in December 2006.

"TJX had a duty to monitor its systems vigorously," the report states.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.