Advertising

The Seattle Times Company

NWjobs | NWautos | NWhomes | NWsource | Free Classifieds | seattletimes.com

The Seattle Times

Nation & World


Our network sites seattletimes.com | Advanced

Originally published February 22, 2007 at 12:00 AM | Page modified February 22, 2007 at 12:58 AM

E-mail article     Print view

Retailer's data breach wider than believed

Retail giant TJX, whose stores include discount clothing chains T. J. Maxx and Marshalls, said Wednesday a computer-security breach stretched...

The Washington Post

WASHINGTON — Retail giant TJX, whose stores include discount clothing chains T.J. Maxx and Marshalls, said Wednesday a computer-security breach stretched back 10 months earlier than it had originally thought, compromising credit- and debit-card data, driver's license numbers, and names and addresses.

The announcement underscores a trend of breaches involving sensitive credit-card data and reflects failures to properly secure computer systems, to notify customers when breaches occur and to update laws for the cybercrime age, lawmakers and analysts said.

T.J. Maxx and Marshalls each have seven locations in the Seattle-Tacoma metropolitan area.

TJX said that while it first thought the intrusion took place from May 2006 to January 2007, it now thinks its computer system was also hacked in July 2005 and on "various subsequent dates" in that year.

The company first reported the intrusion in January, a month after it said it discovered the breach.

It has refused to say how many customers may have been affected and how many have been notified.

"We don't have a number for you there. Our work is not finished," spokeswoman Sherry Lang said Wednesday.

More than 50 computer experts are helping investigate the breaches, she said.

Banks that issued the credit cards have not said how much they have had to cover in fraud-related losses.

More than 30 states, including Washington, have laws that require companies to notify customers as soon as possible when a breach has occurred, although most of the statutes allow companies to delay notification while law-enforcement agencies investigate.

A bipartisan group of senators had reintroduced legislation that would mandate customer notification and require companies that maintain personal information to establish internal policies to protect it.

"Americans live in a world where their most sensitive personal information can be accessed and sold to the highest bidder, with just a few keystrokes on a computer, yet our privacy laws haven't kept pace," Sen. Patrick Leahy, D-Vt., said in a written statement when the legislation was reintroduced this month.

advertising

The credit-card industry has set up rules for data protection called the Payment Card Industry Data Security Standard.

They include encrypting transmission of cardholder data, regularly testing security systems and processes, and restricting access to data to those with a "need to know."

But most large retailers have not complied with the standard, and noncompliance is about 80 percent among smaller retailers, said Avivah Litan, an analyst with Gartner, an information-technology research firm.

Copyright © The Seattle Times Company

Senate Democrats split on health bill's fate

UPDATE - 06:32 PM
SC gov faces 37 charges he broke state ethics laws

U.K. started planning early for war, leaked papers show

Vaccine to kill nicotine buzz now in late tests by small drug firm

India's feeling bruised even before White House visit

Advertising

Video

PNW Magazine | Easy As Pie
A little friendly competition between professional pie-baker Kate McDermott and The Seatttle Times' Kathleen Triesch Saul is handled with great taste.

Real Salt Lake wins MLS Cup
Raw Video | Real Salt Lake fans celebrate
Raw Video | Real Salt Lake receives the MLS Cup trophy
Real Salt Lake fans enter Qwest Field
Raw Video | MLS Cup Opening Ceremony
LA Galaxy's David Beckham
Real Salt Lake's Kyle Beckerman
MLS trophy arrives in Seattle
Chittenden Locks Inspection

Marketplace

 
Most read
Most commented
Most e-mailed
 
 
Advertising