 |
Full Text Of TJX Statement About Data Breach
Written by BUSINESS WIRE
January 18, 2007
January 17, 2007 03:22 PM Eastern Time
The TJX Companies, Inc. Victimized by Computer Systems Intrusion; Provides Information to Help Protect Customers
FRAMINGHAM, Mass.--(BUSINESS WIRE)--The TJX Companies, Inc. (NYSE:TJX) today announced that it has suffered an unauthorized intrusion into its computer systems that process and store information related to customer transactions. While TJX has specifically identified some customer information that has been stolen from its systems, the full extent of the theft and affected customers is not yet known. This intrusion involves the portion of TJX’s computer network that handles credit card, debit card, check, and merchandise return transactions for customers of its T.J. Maxx, Marshalls, HomeGoods and A.J. Wright stores in the U.S. and Puerto Rico, and its Winners and HomeSense stores in Canada, and may involve customers of its T.K. Maxx stores in the U.K. and Ireland. The intrusion could also extend to TJX’s Bob’s Stores in the U.S. The Company immediately alerted law enforcement authorities of the crime and is working closely with them to help identify those responsible. TJX is also cooperating with credit and debit card issuers and providing them with information on the intrusion.
TJX is conducting a full investigation of the intrusion with the assistance of several leading computer security and incident response firms and is seeking to determine what customer information may have been compromised. The Company is committed to providing its customers with more information when it becomes available.
With the help of leading computer security experts, TJX has significantly strengthened the security of its computer systems. While no computer security can completely guarantee the safety of data, these experts have confirmed that the containment plan adopted by TJX is appropriate to prevent future intrusions and to protect the safety of credit card, debit card and other customer transactions in its stores.
Ben Cammarata, Chairman and Acting Chief Executive Officer of The TJX Companies, Inc., stated, “We are deeply concerned about this event and the difficulties it may cause our customers. Since discovering this crime, we have been working diligently to further protect our customers and strengthen the security of our computer systems and we believe customers should feel safe shopping in our stores. Our first concern is the potential impact of this crime on our customers, and we strongly recommend that they carefully review their credit card and debit card statements and other account information for unauthorized use. We want to assure our customers that this issue has the highest priority at TJX.”
Important Information for Customers
TJX has established a special helpline for its customers who have questions about this situation. Customers may reach the helpline toll-free at 866-484-6978 in the United States, 866-903-1408 in Canada, and 0800 77 90 15 in the United Kingdom and Ireland.
TJX will also provide information for customers on its website, www.tjx.com, including tips on preventing credit and debit card fraud and other steps customers may take to protect their personal information.
TJX strongly recommends that customers carefully review their account statements and immediately notify their credit or debit card company or bank if they suspect fraudulent use.
Actions Taken By TJX
Upon discovery of the intrusion in mid-December, 2006, TJX immediately notified and began working closely with law enforcement authorities, including the United States Department of Justice and Secret Service and the Royal Canadian Mounted Police. The Company has coordinated its actions with these authorities and provided all assistance requested to seek to identify the criminals responsible for this incident. TJX maintained the confidentiality of this intrusion as requested by law enforcement.
The Company immediately engaged General Dynamics Corporation and IBM Corporation, two leading computer security and incident response firms. TJX has been working aggressively with these firms to monitor and evaluate the intrusion, assess possible data compromise, and seek to identify affected information. These firms have assisted TJX in further securing its computer systems and implementing security upgrades.
TJX promptly notified and began working closely with the major credit card companies (American Express, Discover, MasterCard and VISA) and entities that process our customers' transactions. The Company has been providing them information including all requested credit and debit card information.
Information About the Intrusion
Through its investigation, TJX has learned the following with respect to the intrusion:
An unauthorized intruder accessed TJX's computer systems that process and store information related to customer transactions for its T.J. Maxx, Marshalls, HomeGoods and A.J. Wright stores in the U.S. and Puerto Rico and its Winners and HomeSense stores in Canada.
The Company is concerned that the intrusion may extend to the computer systems that process and store information related to customer transactions for T.K. Maxx in the U.K. and Ireland, although TJX’s investigation has not yet been able to confirm any such intrusion. It is possible that the intrusion may extend to Bob's Stores.
Portions of the information stored in the affected part of TJX’s network regarding credit and debit card sales transactions in TJX’s stores (excluding Bob’s Stores) in the U.S., Canada, and Puerto Rico during 2003, as well as such information for these stores for the period from mid-May through December, 2006 may have been accessed in the intrusion. TJX has provided the credit card companies and issuing banks with information on these and other transactions.
To date, TJX has been able to specifically identify a limited number of credit card and debit card holders whose information was removed from its system and is providing this information to the credit card companies. In addition, TJX has been able to specifically identify a relatively small number of customer names with related drivers' license numbers that were also removed from its system, and TJX is contacting these individuals directly.
TJX is continuing its investigation seeking to determine whether additional customer information may have been compromised. TJX does not know if it will be able to identify additional information of specific customers that may have been taken.
The Company does not yet have enough information to estimate the extent of the financial cost it will incur as a result of this situation, and does not expect to be able to quantify the estimated financial impact of this issue at the time TJX announces January 2007 sales.
The TJX Companies, Inc. is the leading off-price retailer of apparel and home fashions in the U.S. and worldwide. The Company operates 826 T.J. Maxx, 751 Marshalls, 271 HomeGoods, and 162 A.J. Wright stores, as well as 36 Bob’s Stores, in the United States. In Canada, the Company operates 184 Winners and 68 HomeSense stores, and in Europe, 212 T.K. Maxx stores. TJX’s press releases and financial information are also available on the Internet at www.tjx.com.
SAFE HARBOR STATEMENTS UNDER THE PRIVATE SECURITIES LITIGATION REFORM ACT OF 1995: Various statements made in this release are forward-looking and involve a number of risks and uncertainties. All statements that address activities, events or developments that we intend, expect or believe may occur in the future, including projections of earnings per share and same store sales, are forward-looking statements. The following are some of the factors that could cause actual results to differ materially from the forward-looking statements: the results and effects of the intrusion into our computer system including the outcome of our investigation, the extent of customer information compromised and consequences to our business including effects on sales and liabilities and costs in connection with this intrusion; our ability to successfully expand our store base and increase same store sales; risks of expansion and costs of contraction; our ability to successfully implement our opportunistic inventory strategies and to effectively manage our inventories; successful advertising and promotion; consumer confidence, demand, spending habits and buying preferences; effects of unseasonable weather; competitive factors; factors affecting availability of store and distribution center locations on suitable terms; factors affecting our recruitment and employment of associates; factors affecting expenses; success of our acquisition and divestiture activities; our ability to successfully implement technologies and systems and protect data; our ability to continue to generate adequate cash flows; availability and cost of financing; general economic conditions, including gasoline prices; potential disruptions due to wars, natural disasters and other events beyond our control; changes in currency and exchange rates; import risks; adverse outcomes for any significant litigation; changes in laws and regulations and accounting rules and principles; adequacy of reserves; closing adjustments; effectiveness of internal controls; and other factors that may be described in our filings with the Securities and Exchange Commission. We do not undertake to publicly update or revise our forward-looking statements even if experience or future changes make it clear that any projected results expressed or implied in such statements will not be realized.
|
 |
Advertisement 
 
|
Evan Schuman is the former retail technology editor for eWEEK.com, PCMagazine, CIOInsight and retail reporter for RISNews and Consumer Goods Technology. Having covered IT issues for 21 years - and other stuff like legal affairs, politics, Wall Street and the environment for about eight years before that - Schuman is in a good position to gripe about technology trends and sometimes accidentally make a good point.
|
|
|
 |
It's 9 PM on a Saturday and Bill hits the E-Commerce site of his local pizza parlor to order a pie with pineapple and anchovy toppings. The site knows his favorite orders, and his payment data and his order are quickly processed. then it flashes a message that they just ran out of pineapple and asks would he care for an alternative topping?
The European Union on Wednesday (Oct. 8) proposed E-Commerce rules for the 27 nations under its jurisdiction, but if accepted, these rules would likely be mirrored in Asia and North America.
Japan's NTT and three large Japanese retail chains—Bic Camera, Nojima and Runsystem—confirmed Thursday (Oct. 9) a trial that the group says will "securely integrate the reward cards of more than 100 retailers into a single mobile phone."
When eBay on Monday (Oct. 6) announced that it was buying alternative payment vendor Bill Me Later for $820 million in cash and about $125 million worth of outstanding options, the alternative payment landscape got a lot more complicated.
Google's YouTube on Tuesday (Oct. 7) officially opened its click-to-buy program, allowing users to click on a song they like in the background of a video and instantly download it. Or perhaps click on a product seen in a video or on a poster in a video.
Fellow blogger Steve Sommers, over at Shift4, has been following up some of his sharper comments from last week about PCI's efforts to charge listing fees to get on the official list of PCI-compliant applications. "PCI's justification for the fee is that they want to be self sufficient and independent for the card brands. This is good in theory if you ignore two glaring obstacles," he wrote.
In 2006, T-Mobile lost "a storage device with 17 million mobile telephone data records" that included "names, addresses and cell phone numbers, (and) the data, in some cases, also included the date of birth or E-mail addresses," T-Mobile said in a statement this week. Why are we just hearing about this now? T-Mobile never bothered to announce it until the data started surfacing on the Web and German media started reporting it.
Amazon has been awarded a Patent on a methodology for rewarding customers who post a lot of reviews. As the Register in the U.K. so aptly phrased it, "The self-described patent reform advocates at Amazon.com don't seem to have broken their habit of putting legal hooks on just about anything they dream up."
The Staples Canada trial with re-usable RFID active tags has worked out well and will be expanded to 10 more stores by the first week of December, but it's the security arrangements around the devices attracting the most attention.
If you're going to be in New York City on Wednesday (Oct. 15), you might want to drop by the StorefrontBacktalk panel on strategic kiosk use (yes, there is such a thing) at the Javits Center during 
When the PCI Council officially unveiled PCI 2.1 on Wednesday (Oct. 1), it included virtually no meaningful changes from what PCI had announced the key changes would be back in mid-August. But far from the mild tweak officials had described, the final PCI 1.2 version actually includes dozens of wording changes, most of which reflect technology changes since 1.1 was released two years ago.
Many retailers have done little to formalize their IT risk management process and simplistic spreadsheets with arbitrary (or non-defensible) risk levels and a cute "stoplight" (i.e., red, yellow, green) summary are common, argues GuestView Columnist David Taylor.
When a manager tries to connect a new kind of device to a network, IT is typically all over it, trying to discover potential security issues. But the much bigger risk is when a longtime network element, one that has been seen for years as innocuous and trivial, slowly becomes more intelligent and connected and quietly morphs into something that is anything but innocuous.
A U.S. Patent for a payment card that can be turned on and off was issued last year with little fanfare, but it's owners are now starting to shop it around to retailers and banks. The premise is that when the consumer turns off the card, neither the card nor its associated numbers can be used for any purchases.
Why do vendors—including some top-notch vendors—insist of taking something very good and trying to make it into something it's not? Why bother? It's as though the need to hype was some prenatal attribute their genes absorbed when their mothers saw too many used car commercials.
Most merchants and application vendors seriously underestimate both the scope and the force of the Payment Applications Data Security Standard (PA DSS). If so, it's only because they haven't read the standard or don't immediately grasp what's involved, said GuestView Columnist David Taylor.
By agreeing to pay $250 thousand for "assistive technology for blind consumers," Apple has settled a lawsuit that accused the company of not making its iTunes site accessible to those with visual difficulties.
Visa is running a mobile phone trial where consumers will be able to transfer money using their phones to any other Visa user. "The pilot, which is intended to begin by the end of 2008, is the first U.S.-based trial testing mobile money transfers between Visa accounts," Visa said, but it has already been doing it in 13 countries in Europe, the Middle East and Asia.
Merged channel is all the rage—as it should be—but one key analyst is arguing that retailers must merge their channels, not their IT groups. The problem is that most IT functions in-store are behind-the-scenes. To put a finer point on it, argues Nikki Baird of Retail Systems Research, is that in-store IT is not usually creating things that are customer-facing.
Many Gen Y shoppers have never known—or believed they had—any privacy, so they are dramatically more willing to give up or sell personal data in exchange for something they see as having value. Their attention span is short, their multi-tasking skills are high and many find the idea of paying for software quaint and old-fashioned.
A recent Best Buy incident raises an interesting security question: What call center verification methods should be used to authenticate customers before allowing them to cancel or change an order?
A second defendant in the so-called TJX Breach case—which also had at least seven other major retail chains as fellow victims—pleaded guilty Monday (Sept. 22), this time to charges of conspiracy, unauthorized access to computer systems, access device fraud and identity theft.
GuestView Columnist David Taylor advises that IT leaders start prepping their frequent flyer miles as new PCI regs will be sending them on the road a lot more often. If you use third parties to collect, process or store confidential data for you, then you need to do more than simply get a letter from them once a year that says they are doing right by your data, they're PCI compliant or what have you. You'll need to visit.
Here's a frightening question: "Who is going to report ‘questionable' assessments of vendor applications when neither of the parties to the process (the vendor and the assessor) has any motivation to do so?"
When a major site performance research site reported last week that the Oriental Trading Company Web site had a major meltdown through all of August, Oriental Trading officials raised questions about whether the report was correct. On Monday (Sept. 15), two leading site traffic tracking firms—including the firm that issued the original report—backed Oriental Trading's position, to varying degrees.
After a one-year trial, Walgreens has now officially committed to making its 600,000-square-foot distribution center in Anderson, S.C., fully RFID automated with a system that alerts employees before they load a shipment on the wrong truck bound for retail locations throughout the Southeast.
As one of the 11 defendants in the federal data breach charges involving TJX and others pleaded guilty Thursday (Sept. 11), federal officials confirmed that there are quite a few other victims of the breach that have yet to be publicly identified.
Merged channel and E-Commerce issues will be the fighting words of the day at Retail Perspectives 2008 in Montreal on Monday (Sept. 22), where StorefrontBacktalk will be speaking and moderating discussions on those topics plus PCI, in-store strategies, supply chain and global tactics.
Trying a grocery approach to buy online pick up in store, the 181-store Meijer supermarket on Thursday (Sept. 11) launched a trial called Grocery Express. It allows customers to make purchases online, schedule a pickup time and then drive to a local Meijer to have the pre-bagged and already-paid-for groceries loaded into their cars.
A U.K. firm has developed an on/off "switch" for RFID cards that could protect cardholders from being hacked. The cardholder activates the RFID transmission by squeezing the card between his thumb and forefinger when it must be scanned by a reader.
Online customers trying to reach the 76-year-old crafts catalogue retailer Oriental Trading Company found a lot more hassle than crafts last month, according to the latest figures from online availability research firm Gomez. But the apparent Web performance plunge may not have happened, and it's a fascinating look into the limits of Web traffic analysis.
In what some software vendors dub a shakedown, a PCI list of compliant applications—which retailers will soon be limited to purchasing from, if they want to stay PCI compliant—is excluding software vendors who decline to pay a financial tribute to PCI.
Rite Aid has severed part of a 9-year-old deal with Drugstore.com and will take back its over-the-counter medication online purchases, a move that forced Drugstore.com to "significantly cut its outlook for fiscal 2008."
A California startup is touting technology that it argues will make RFID chips that can't be cloned. Verayo's approach is based on a circuit-building approach called PUFs (Physically Unclonable Functions), which uses subtle chip differences to fuel a challenge-and-response system.
Almost a year ago, California Gov. Arnold Schwarzenegger vetoed a controversial state breach bill that would have forced retailers to reimburse financial institutions for replacing compromised credit and debit cards.
With a new entry into the browser battleground—Google's Chrome—comes more customization nightmares. This problem is going to get a lot worse very quickly as many E-Commerce sites try and get more complex with more interactivity, multimedia and even 3-D experiments at the same time as consumers are getting more comfortable playing with their browser settings.
Matt Carey, who had served as CTO for both eBay and Wal-Mart, became the new Home Depot CIO on Monday (Sept. 8), the $77 billion home improvement chain has confirmed. Home Depot said that Carey is joining the company directly from his SVP/Chief Technology Officer role at eBay, a job that—according to eBay—he started Feb. 1, 2006.
If the slip of a lip can sink a ship, perhaps a retailer's flick of the click can kill a prestigious campaign mighty quick. The best way for a retail chain to make a customer happy is to offer him/her a program that few others can get. And the best way to undermine that—as Best Buy discovered on Wed. (Sept. 3)—is to then accidentally make that offer to every single reward customer you have.
Now that the PCI Council has confirmed that version 1.2 will be unveiled Oct. 1, the pre-briefings set for Oct. 21-23 in Belgium are especially perplexing. The initial intent of the briefings had been to show respect to European industry leaders, to give them an opportunity to provide feedback on 1.2 before it was solidified.
Over the last month, I've been struck by an unusually large number of reader E-mails that fundamentally question whether E-Commerce will ever truly work: Whether it will consistently make money, be profitable and be, well, worth all of the effort.
Security is nothing if not filled with seeming contradictions, and the latest version of PCI—slated to be officially unveiled next month (October)—is highlighting a beauty: To most effectively protect payment-card-related systems, protection must be focused on anything that is not related to payment card data.
Quite a few retailers have been involved in site changes to make the Web more accessible to those with vision difficulties, but Target has been the most aggressive in fighting such efforts. As such, Target's settlement has an especially strong chance of pressuring retailers to aggressively embrace such changes.
Wal-Mart on Wednesday (Sept. 3) launched what it dubbed the Walmart Smart Network—a series of next-generation digital-ad systems—to 2,700 stores. The funky aspect of this rollout is that all 27,000 screens will be centrally controlled via an Internet Protocol Television connection.
Site navigation problems and unpleasant booking engines are driving customers away from online travel sites and pushing them through the doors of traditional, more personable travel agencies. Even though sales for online travel sites are growing, fewer travelers are actually booking their trips online.
Calvin Klein finally gave its HTML blessing to E-Commerce, offering its first for-sale items on its Web site, although the E-Commerce launch is U.S.-only. Anyone visiting from outside the United States will be routed to the existing corporate brochure site.
It seems clear that most retailers are adopting one of two distinctly different strategies when it comes to data security and compliance. Let's label them Cost-Effective Compliance (CEC) and Compliance-Driven Security (CDS). Both approaches are based on best practices and solid risk management principles. But, GuestView Columnist David Taylor argues, they lead to quite different spending patterns, technology decisions and business cultures.
A retail IT lesson from the world of politics? Maybe. Web tracking firm Keynote was studied the text message blast sent by the U.S. presidential campaign of Barack Obama, the one in which his campaign promised to tell supporters his VP selection before it was broadly announced.
Has Amazon decided what it wants to be when it grows up? More to the point, are there indications that it has now decided that one thing it does not want to be is yet another thin-margined retailer?
Almost a year after TJX settled with banks and bank associations impacted by the worst data breach in credit card history, another bank has come forward with its own lawsuit against the retailer, claiming the incident compromised some 4,000 of its customer accounts.
The number of data breaches reported as of Aug. 22 of this year has already surpassed the total number in all of 2007, including a new one from Macy's impacting some 4,100 customers.
On the best-paid list of CIOs at publicly held companies, Best Buy's Bob Willett ($4.7 million), Home Depot's Bob DeRodes ($4.3 million) and Kohl's Thomas Kingsbury ($2.5 million) stand at the top, doing the pocket-protector crowd proud.
With the frequent product changes executed by any large e-tailer's site, the tech hurdles of launching a mirror site in another language can be daunting. But this challenge has created a small industry of companies that are trying to facilitate rapid globalization for e-tailers.
JCPenney is testing the Australian waters a bit with an online push. The retailer has a local URL and an Australian company handling all operations, but it's still shipping merchandise from the States and asking Australian shoppers to wait "12 to 14 working days. This "request" prompted one Australian publication to ask "whether Australians would be prepared to wait two weeks to receive something purchased online."
In an overall down market where the 150-store Nordstrom chain is seeing a 4.3 percent sales drop, online operations are accounting for 15 percent, hitting almost 8 percent of all sales. Company execs there now project online to soon top 10 percent.
It's late on a Friday night and as Jane Smith walks into her local grocery frozen food aisle, she notices a neighbor walking away carrying a frozen pizza, right near a digital advertisement for 20 percent off of a Budweiser six-pack. Jane reaches into the freezer to grab her favorite Häagen-Dazs vanilla ice cream but notices that the digital ad instantly changes to hawk 40 percent off fresh apple pie in the bakery section.
It's generally accepted that any key economic issue—whether it's a housing slump, rising gas prices or tax refund checks—can have a sharp impact on business spending. But the IHL Group is floating an interesting theory that recent gas price hikes are going to have a very specific and direct impact on IT spending next year.
After years of trials with only the rarest evidence of CFO-friendly RFID ROI, shelf stock monitoring is quickly emerging as "the first major application of RFID in retail with a strong business case," according to a new report from London-based RFID analyst firm IDTechEx.
These days, when U.S. government officials want to ask questions about privacy and data security, it's never clear if they want to protect consumers' privacy or learn the best way to violate it themselves. But retail execs who want hints can drop by a Sept. 22 hearing at the U.S. Federal Trade Commission's Washington, D.C., headquarters.
Retailers who are worried about RFID security problems will have more details available to them now that a federal judge has killed a gag order on MIT students who had identified flaws in Boston's contactless RFID subway cards.
Based on the PCI Standards Committee's official hints about what will be in the 1.2 release, it appears that clarifying when and how virtualized servers can be PCI compliant didn't make the cut. But before the server and security geeks start lighting their torches and getting all "vigilante" on the card brands, let GuestView Columnist David Taylor make his case for why it won't matter in the slightest.
As major chains are doubling up their focus on computer-savvy young consumers, some are finding their aversion to avatars giving in to their adoration of avarice.
A "persistent and mysterious technical glitch" has severely disrupted business operations at the massive online film rental site Netflix, "potentially affecting millions of its customers."
