TD Ameritrade's 6 million customers hit with security breach
304095
TD Ameritrade warned customers Friday that its client database suffered a security breach, potentially putting their social security numbers and trading information at risk.
284239
Monster.com waited five days to tell users its system had been hacked, in a security breach that resulted in the theft of confidential information for more than a million users, a company executive told Reuters on Thursday.
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.
375551
The vendor issued an alert to some customers, telling them to run the flawed application in order to get it fixed.
319386
SEPTEMBER 24, 2004  - A distributed denial-of-service attack that disrupted Web-based systems at credit card payment processing firm Authorize.
472731
The demise of New Century Financial has been broadly viewed as troubling, as it involves the nationâs $6.5 trillion mortgage securities market.
511400
The worst data breach made public so far -- the one that affected customers of TJX Companies -- is even worse than first thought. Court documents indicate that the number of accounts affected is 94 million, more than double initial estimates.
720185
(InfoWorld) - As more details emerge about the recently disclosed security breach at TJX Companies, lawmakers in Massachusetts are considering new laws that would put the onus for paying for such breaches on retailers and merchants, rather than banks and credit unions, the Wall Street Journal reported Thursday. In Massachusetts, Attorney General Martha Coakley is hoping to force significant changes to the manner in which companies are allowed to collect, store, and protect sensitive consumer data. "[Coakley] is looking at a number of issues and working with the legislature to see what types of measures we can implement to better protect consumers," said Melissa Sherman, Coakley's press secretary. But security and privacy experts agree that new laws, in themselves, won't prevent a repeat of the data breach experienced by TJX, which continues to increase in scope. And that the hack of that retailer's network should provide a chilling lesson to businesses that are failing to adequately safeguard their sensitive information. As illustrated by the retailer's continued discovery of new incidents of IT systems intrusion, enterprises that don't have sufficient security tools in place will have a hard time simply piecing together the details of what has happened when their data is attacked, industry watchers observed. On Feb. 21, Framingham, Mass.-based TJX announced that it had discovered a new set of IT systems intrusions that exposed the personally identifiable information of an undetermined number of its customers. Company officials said that in addition to the IT systems break-ins TJX detailed in January 2007 -- which occurred during 2003 and between May and December 2006 -- it now believes that intruders also infiltrated its databases repeatedly during 2005. TJX offered no further details regarding the nature or volume of the information that was accessed by outsiders during the newly reported intrusions, and said that the firm only recently discovered the additional incidents, which started in July 2005 and continued over a period of time that the company classified only as "subsequent dates," in a statement. The fact that TJX -- which has already been publicly chided by MasterCard International, among others, for failing to meet established data security standards -- is still unraveling the exact details of the attack serves as testament to the notion that ill-prepared businesses will struggle just to understand how and when they've been penetrated, experts said. "The scary thing is that we are learning that this type of situation is not uncommon. It's like someone broke into your house by picking the lock and only took items you wouldn't notice were missing," said Richard Mogull, an analyst with Gartner, in Stamford, Conn. "Companies such as retailers are collecting tons of information and not securing it properly, and if they don't have sufficient monitoring technology in place, which most firms do not, it's surprising that they can figure out what has happened at all," he said. Makers of security software designed to help companies fight such data loss contend that IT executives, when they first try out one of the programs, are typically shocked to find out where all their sensitive data is located and how it is being handled by employees and business partners. "Most people are really surprised by what they see. We were even shocked when we turned on the ILP technology for the first time," said Devin Redmond, director of security products at San Diego-based Websense, which acquired information leakage prevention (ILP) specialist PortAuthority Technologies for $90 million in December 2006. "It is amazing to see how much data is moving around the network and being used in ways that existing security policies don't cover," Redmond said. "For companies who haven't addressed the problem that are attacked, the biggest challenge is simply figuring out where your sensitive data might reside to begin with, and what was done to it." Privacy watchdogs said that many businesses, specifically retailers such as TJX, have been aggregating vast amounts of sensitive consumer data for years with little regard for its security. Because businesses struggle just to understand the parameters of such an attack, there is little hope that large companies will soon be able or willing to more intelligently defend their data, said Lillie Coney, associate director at the Electronic Privacy Information Center (EPIC) in Washington, DC. -- even when faced with glaring examples of what can go wrong. "Incidents like the one experienced by TJX provide the best argument for not holding onto large amounts of sensitive information, but there's no evidence yet that these events have pushed other companies to improve their own data security efforts," Coney said. "This is exactly the situation that the criminals want; they can move in and steal the data and it's hard to tell what they made off with, which lets them keep doing business longer." One of the major problems in convincing companies to invest in technologies to defend information from internal and external threats, experts said, is that security workers still have a hard time justifying the cost of expensive new tools to senior executives, who want to know why the systems they've already installed aren't enough. Making a case for how a data breach could affect a company's bottom line should be simple, but many business leaders are unwilling to dip into their coffers for new IT defense systems, EPIC's Coney contends. "If you consider the problem in terms of risk analysis and the potential cost of an incident that exposes sensitive information, including the damage to a company's reputation, it shouldn't be a hard case to make," Coney said. "But getting companies to think like that is still a challenge, as the IT workers don't have a way to position the issue from a bottom-line standpoint; eventually someone will make a case for liability with one of these breaches, and that's when people will really get it." Research company, Ponemon Institute, based in Elk Rapids, Mich., estimates that information losses cost U.S. companies an average of $182 per compromised record in 2006. However, other industry watchers, including Gartner's Mogull said there's no real way to quantify the long-term damage done to a firm's reputation by a TJX-like event. The analyst said that such incidents are causing many enterprises to reconsider their data protection policies and look into new security technologies, but few companies are taking a comprehensive approach to addressing the problem of information security and are instead focused on potential return on investment (ROI) -- a serious mistake, he said. "Companies are trying to do ROI analysis to decide what they need to spend or what they'll lose in an incident, but that's a silly way to do it. The estimates that are out there for the cost of a breach are mostly worthless because they can't take into account the long-term effect," Mogull said. "What they really need to do is find where the data is and how it is being used in their business and try to create smarter policies," he said. "Trying to piece things together after an attack has already happened clearly isn't going to cut it."
731737
Apparently it&#39;s not just unwary individuals that fall victim to online scammers. Even large corporations, it seems, can get suckered into parting with their money by devious&#160;phishers.Case in point: Eden Prairie, MN.-based grocery chain Supervalu, which earlier this year got conned into depositing more than $10 million into two fraudulent bank accounts before recognizing the ruse. Details of the case are contained in court documents filed in connection with two forfeiture cases stemming from the incident.According to federal court filings in the U.S. District Court for the District of Idaho, the fraudulent activity took place in late February and early March this year. In the court filings, Stephen Kilgroff, Supervalu&#39;s vice president of legal affairs, said that on February 26 and 28 the company received two separate e-mails, one purporting to be from an employee at American Greetings Corp. and the second from an employee at Frito-Lay, both company-approved vendors.Both e-mails told Supervalu to send future payments for each vendor to new bank account numbers. In the case of the e-mail that purported to be from American Greetings Corp., Supervalu was advised to send payments to an HSBC account in Miami. The other e-mail advised Supervalu to send Frito-Lay payments to an account at First Security Bank in Rogers, Arkansas.Between Feb 28 and March 3, Supervalu deposited just over $6.5 million via multiple wire-transfers to the HSBC account, thinking that it was sending the money to American Greetings Corp. Similarly, on March 2 it made eight separate wire-transfers to the bank in Arkansas, depositing a total of $3.6 million to an account it thought belonged to Frito-Lay.In addition to the $6.5 million deposited by Supervalu into the HSBC account, an additional amount of $500,000 had been deposited into the same account by a second company, identified as &quot;ROHM&quot; on court documents. No information has been available concerning the second company, and it is not a party to subsequent litigation.Around March 6, according to the filings made by Kilgroff, Supervalu discovered that it had been &quot;induced&quot; into making the transfers to the bogus accounts. Following the discovery of the fraud, Supervalu quickly notified the appropriate law enforcement authorities, who managed to recover nearly all of the money before it could be withdrawn from the accounts.The recovered money is now being claimed by Frito-Lay, American Greetings and Supervalu. In making the claim to the recovered money, Frito-Lay said that it believes the money belongs to Supervalu and said supported that company&#39;s claim to ownership of the misdirected funds.&quot;However to the extent there is any determination that the ownership of these funds changed from Albertsons/Supervalu [the Albertsons grocery chain was recently acquired by Supervalu] to Frito-Lay (as a result of the attempted transfer, the misdirection, or any other development) Frito-Lay makes this claim to these funds in the alternative and subject to any claim of ownership by Albertsons/Supervalu&quot; the company said in an affidavit.A federal judge is expected to rule sometime in November on which firm should receive the recovered funds.A spokeswoman from Supervalu responded via e-mail to a request for comment. &quot;As indicated by the forfeiture complaint filed by the U.S. Attorney&#39;s Office in Boise, Supervalu was the target of attempted financial fraud,&quot; spokeswoman Haley Meyer said. &quot;Due to our internal controls and processes, we were able to quickly discover and report this to the FBI. As a result of the quick work of the Boise FBI Office and the U.S. Attorney, any funds lost are minimal.&quot;Computerworld is an InfoWorld affiliate.&#160;
198004
Framingham discounter TJX Cos. failed to keep adequate security safeguards to protect customer information from hackers who stole millions of credit and debit card numbers after intercepting wireless transactions at two Miami area Marshalls stores, Canadian privacy officials said yesterday.
444524
TD AMERITRADE pulls off a record quarter.
679026
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. &quot;We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out,&quot; he said.The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.The missing backup tape was unencrypted.Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. &quot;Clearly that number includes many of the national retail organizations,&quot; he said.The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit-card accounts, a common form of identity theft.Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit monitoring services to those affected by the breach.In 2006, retailer TJ Maxx discovered that thieves had&#160;broken into its computer networks, stealing an estimated 94 million credit- and debit-card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.GE Money is a division of General Electric.
602648
More than 94 million accounts were affected in the theft of personal data from TJX Cos. , a banking group alleged in court filings, more than twice as many accounts as the Framingham retailer has said were affected in what was already the largest data breach in history.
758125
Customers are getting more demanding, while security market is seeing a gradual consolidation around fewer players.
23018
ID theft milestone reached The total number of US customer records compromised as a result of security blunders has hit the 100m milestone.â¦
428558
The TJX Companies, Inc., a discount retailer, said Friday it settled class action lawsuits in the United States, Canada and Puerto Rico stemming from a massive security breach of customer data that affected at least 45 million credit and debit cards.
507354
The number of security attacks reported by mobile phone operators in 2006 jumped fivefold over the year before, a McAfee study reports.