Canadian Government Sheds Light On TJX Breach

Attack was conducted via wireless links at two Miami Marshall's stores, investigation reveals

Tim Wilson, Editor in Chief, Dark Reading, Contributor

September 25, 2007

2 Min Read

Since TJX Companies disclosed its massive data breach back in January, hackers, security pros, banks, and victims have all been asking one common question: Exactly how did it happen? (See TJX Breach Skewers Customers, Banks.)

Officially, TJX still isn't telling. But Canadian government investigators this morning issued a report on their findings, which were derived from a nine-month study that received the retail giant's cooperation. The report confirms some earlier news reports, while contradicting others.

The Canadian government investigation confirms that the attackers gained access to TJX data via wireless LANs at two retail stores over a period of many months. The attackers gained access to the data through two Marshall's stores in the Miami area -- not in Minnesota or Massachusetts, as previously reported, officials said.

The wireless LANs were secured only by Wired Equivalent Privacy (WEP), a technology that has been known to be vulnerable for more than a year.

The criminals used the wireless connection to access TJX's Retail Transaction Switch servers, which store information about customer transactions throughout North America. Investigators suspect that the data was collected via some sort of malware, but that the attackers have implemented some method of deleting, removing, or obfuscating the malware, which has made the exact method of attack difficult to pinpoint -- and the criminals impossible to find.

Canadian officials declined to give details on how the tapping of the wireless connections occurred, for fear of giving other hackers ideas on how to do it.

Not surprisingly, the report concludes that TJX did not take sufficient steps to secure or dispose of the sensitive data. The company's upgrade from WEP to WPA took too long, and sufficient encryption was not put in place, it says.

The report also says TJX did not do enough to monitor its systems. The risk of a breach "was foreseeable," the report says, and the company should have been aware of the attack prior to its discovery in December 2006.

"TJX had a duty to monitor its systems vigorously," the report states.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading


Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights