September 26, 2007 8:53 AM PDT
Privacy experts: T.J. Maxx breach was foreseeable
- Related Stories
Who says security breaches are small potatoes?May 23, 2007
Banks file data breach suit against TJXApril 25, 2007
TJX says 45.7 million customer records were compromisedMarch 29, 2007
T.J. Maxx parent company sued in credit card hack probeMarch 21, 2007
T.J. Maxx probe finds broader hackingFebruary 21, 2007
T.J. Maxx hack exposes consumer dataJanuary 18, 2007
- Related Blogs
TJX agrees to settlement in class action suits
September 25, 2007
TJX hackers got comfortable, very comfortable
April 11, 2007
"The company collected too much personal information, kept it too long, and relied on weak encryption technology to protect it, putting the privacy of millions of its customers at risk," Jennifer Stoddart, the privacy commissioner of Canada, wrote in the report, which was released Tuesday.
Modern crime made a large-scale breach of this kind inevitable, Stoddart concluded. "Criminal groups actively target credit card numbers and other personal information," she said in the report. "A database of millions of credit card numbers is a potential goldmine for fraudsters, and it needs to be protected with solid security measures."
What made such a breach more likely was that the information had been kept for a long time, she said. "The TJX breach is a dramatic example of how keeping large amounts of sensitive information, particularly information that is not required for business purposes, for a long time can be a serious liability."
Stoddart said the affair was a "wake-up call" for all retailers.
Frank Work, the information and privacy commissioner of Alberta, added: "They must collect only the personal information necessary for a transaction."
TJX disclosed in January that its computer system had been breached, putting millions of credit and debit card numbers as well as other personal information at risk. In May, TJX said it believed the hackers gained access to its information via the Wi-Fi networks.
Details of 45 million customers of TJX were put at risk. The company could offer no comment at the time of writing.
Colin Barker of ZDNet UK reported from London.
1 commentJoin the conversation! Add your comment