Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Canadian Government Sheds Light On TJX Breach

Attack was conducted via wireless links at two Miami Marshall's stores, investigation reveals

Since TJX Companies disclosed its massive data breach back in January, hackers, security pros, banks, and victims have all been asking one common question: Exactly how did it happen? (See TJX Breach Skewers Customers, Banks.)

Officially, TJX still isn't telling. But Canadian government investigators this morning issued a report on their findings, which were derived from a nine-month study that received the retail giant's cooperation. The report confirms some earlier news reports, while contradicting others.

The Canadian government investigation confirms that the attackers gained access to TJX data via wireless LANs at two retail stores over a period of many months. The attackers gained access to the data through two Marshall's stores in the Miami area -- not in Minnesota or Massachusetts, as previously reported, officials said.

The wireless LANs were secured only by Wired Equivalent Privacy (WEP), a technology that has been known to be vulnerable for more than a year.

The criminals used the wireless connection to access TJX's Retail Transaction Switch servers, which store information about customer transactions throughout North America. Investigators suspect that the data was collected via some sort of malware, but that the attackers have implemented some method of deleting, removing, or obfuscating the malware, which has made the exact method of attack difficult to pinpoint -- and the criminals impossible to find.

Canadian officials declined to give details on how the tapping of the wireless connections occurred, for fear of giving other hackers ideas on how to do it.

Not surprisingly, the report concludes that TJX did not take sufficient steps to secure or dispose of the sensitive data. The company's upgrade from WEP to WPA took too long, and sufficient encryption was not put in place, it says.

The report also says TJX did not do enough to monitor its systems. The risk of a breach "was foreseeable," the report says, and the company should have been aware of the attack prior to its discovery in December 2006.

"TJX had a duty to monitor its systems vigorously," the report states.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Adobe Systems Inc.
  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Manchester United Suffers Cyberattack
    Dark Reading Staff 11/23/2020
    As 'Anywhere Work' Evolves, Security Will Be Key Challenge
    Robert Lemos, Contributing Writer,  11/23/2020
    Register for Dark Reading Newsletters
    White Papers
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: He hits the gong anytime he sees someone click on an email link.
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2020-11-27
    Intelbras TIP200, TIP200LITE, and TIP300 devices allow /cgi-bin/cgiServer.exx?page= XSS.
    PUBLISHED: 2020-11-26
    ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
    PUBLISHED: 2020-11-26
    slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
    PUBLISHED: 2020-11-26
    Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.
    PUBLISHED: 2020-11-26
    An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.