TJX Gets Slap on the Wrist - Twenty-Four Seven Security

« I Missed a Good One | Main | The Rapidly Changing World of Security: A Talk With Sophos »

April 01, 2008
TJX Gets Slap on the Wrist

Anyone waiting for the official penalty for TJX's lax and often egregious disregard for customer data needs to wait no further. I'm sure you all know the story by now of TJ Maxx's (which is owned by TJX) massive data breach, but if you need to catch up quick, just click here.

According to Network World, in a settlement by the FTC, the company will be required to implement extensive security programs as well as obtain audits by independent third parties every other year for 20 years (that's an audit every other year, not implementing security programs every other year).

The FTC found TJX failed to take reasonable and appropriate security measures to protect unauthorized access to a wealth of personal data. The specific charges against TJX, taken from Network World, were as follows:

* Created an unnecessary risk to personal information by storing it on, and transmitting it between and within, its various computer networks in clear text;

* Did not use readily available security measures to limit wireless access to its networks, thereby allowing an intruder to connect wirelessly to its networks without authorization;

* Did not require network administrators and others to use strong passwords or to use different passwords to access different programs, computers, and networks;

* Failed to use readily available security measures, such as firewalls, to limit access among its computers and the Internet; and

* Failed to employ sufficient measures to detect and prevent unauthorized access to computer networks or to conduct security investigations, such as patching or updating anti-virus software.

Going forward, TJX pretty much has to do what any sane and sensible consumer orientated company should be doing already anyway. Makes you wonder what TJX plans to do once the 20 years are up? Maybe start selling your personal information in store...you know, get a free working credit card number with the purchase of 3 pairs of dress socks!

But things aren't totally finished, as the credit card companies still have a lawsuit against TJX which has yet to be settled. And that'll hit TJX where it hurts most -- right in the wallet.