i-net blog

Wow, so much has been in the press the last couple of days about this theft of some 45.7million peoples credit card details from a database held by an US based company called TJX.

Now 45.7million is a hell of a lot of credit cards, but i have to ask what the press has been doing for the last 3 months. TJX actually announced this on the 17th of January and it has taken this long for the national press to think about pressing the “We’re all doomed!” button.

http://www.boston.com/business/globe/articles/2007/01/18/tjx_credit_data_stolen_wide_impact_feared/

For those of us in Europe TJX is better known as TKMax and is used by lots of people. So should we be concerned? Absolutely!

Apart from the inept press, it does raise some really serious issues about large corperations and the controls that are placed on their management of data and information Security.

• First of all they shouldn’t have been storing most of this data. I believe that both Visa and Mastercard say that this type of data should only be stored long enough to carry the transaction. Now there was data stolen going back to December 2002… A pretty long transaction. What the hell where they doing with this data?
• So there was a security breach.. It does happen, but for this to have been going on right under there noses for 16 months and for no one to notice until recently is just plain bad in every sense of the word. Not only did TJX have a whole in their security somewhere, but they seem to have had no audit trail of who was accessing this information and why…Controls, controls, controls…

Does this come under Messrs Sarbense and Oxley? Could we have a CEO going under the guillotine becuase of the ineptitude of his IT and Finance people. I doubt it….

So TJX have some serious problems to sort out, but who is supposed to monitoring these companies and making sure this type of thing cannot happen?

The only good news to report from this sorry mess is that the US authorities have arrested 6 people after they spent some $8m with another 4 people on Florida’s most wanted….

http://www.siliconrepublic.com/news/news.nv?storyid=single8054