Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Canadian Government Sheds Light On TJX Breach

Attack was conducted via wireless links at two Miami Marshall's stores, investigation reveals

Since TJX Companies disclosed its massive data breach back in January, hackers, security pros, banks, and victims have all been asking one common question: Exactly how did it happen? (See TJX Breach Skewers Customers, Banks.)

Officially, TJX still isn't telling. But Canadian government investigators this morning issued a report on their findings, which were derived from a nine-month study that received the retail giant's cooperation. The report confirms some earlier news reports, while contradicting others.

The Canadian government investigation confirms that the attackers gained access to TJX data via wireless LANs at two retail stores over a period of many months. The attackers gained access to the data through two Marshall's stores in the Miami area -- not in Minnesota or Massachusetts, as previously reported, officials said.

The wireless LANs were secured only by Wired Equivalent Privacy (WEP), a technology that has been known to be vulnerable for more than a year.

The criminals used the wireless connection to access TJX's Retail Transaction Switch servers, which store information about customer transactions throughout North America. Investigators suspect that the data was collected via some sort of malware, but that the attackers have implemented some method of deleting, removing, or obfuscating the malware, which has made the exact method of attack difficult to pinpoint -- and the criminals impossible to find.

Canadian officials declined to give details on how the tapping of the wireless connections occurred, for fear of giving other hackers ideas on how to do it.

Not surprisingly, the report concludes that TJX did not take sufficient steps to secure or dispose of the sensitive data. The company's upgrade from WEP to WPA took too long, and sufficient encryption was not put in place, it says.

The report also says TJX did not do enough to monitor its systems. The risk of a breach "was foreseeable," the report says, and the company should have been aware of the attack prior to its discovery in December 2006.

"TJX had a duty to monitor its systems vigorously," the report states.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Adobe Systems Inc.
  • Secure Computing Corp. (Nasdaq: SCUR)

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
    Jai Vijayan, Contributing Writer,  4/15/2021
    Dependency Problems Increase for Open Source Components
    Robert Lemos, Contributing Writer,  4/14/2021
    FBI Operation Remotely Removes Web Shells From Exchange Servers
    Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
    Register for Dark Reading Newsletters
    White Papers
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2021-04-21
    An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.
    PUBLISHED: 2021-04-21
    An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.
    PUBLISHED: 2021-04-21
    An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
    PUBLISHED: 2021-04-21
    An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c.
    PUBLISHED: 2021-04-21
    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.