Banks Fed Up With Retailers’ Security Gaffes

What makes the TJX data breach different from the many that came before it? This marks one of the first times banks or consumers have linked a specific incidence of credit card fraud to a security breach at a specific company, says Jim Lewis, a security expert at the Center for Strategic and International Studies.

Plus, bank executives are fed up and they aren’t going to take it anymore.

That seemed to be the message delivered by the financial community in the wake of the security breach announced by TJX in January. TJX, the Framing­ham, Mass., parent company of discount stores including TJ Maxx and Marshalls, revealed that hackers had stolen an undisclosed number of customer credit card numbers (estimates are in the millions). The reaction to the break-in was swift: The Massa­chusetts Bankers Association said some of its member banks had been able to trace recent fraudulent purchases on credit cards to the TJX breach.

“We believe the financial responsibility for covering losses because of fraud is on the company where the breach occurred,” says association spokesman Bruce Spitzer. “This is something we are pursuing.”

As are others. So far, at least two class-action lawsuits have been filed against TJX (one by banks in Alabama and Ohio, and another by an individual in West Virginia). The Massachusetts Attorney General’s office is investigating TJX’s security practices. The suits and investigations have altered the security breach landscape. “You will see banks start to attempt to hold retailers and other merchants liable” for losses on credit cards, says Behnam Dayanim, a privacy attorney with Paul, Hastings, Janofsky & Walker in Washington, D.C.

As CIO, how do you protect your company from a similar mess? The first thing CIOs should do is discuss with business unit leaders whether personal information (such as addresses, driver’s license data and Social Security numbers) needs to be stored at all. If there’s no compelling business reason to keep it, then the company should discard it after processing any transaction, be it in a brick-and-mortar store or online. But if the storage of the information is viewed as key to increasing sales then the firm must secure the data.

Encryption is one answer. The Cali­fornia security breach notification law (the standard for such laws, which requires businesses to notify customers when personal data has been exposed) permits companies to forgo notification if the personal data was encrypted. But use strong encryption, because lawyers can argue that weak encryption is no protection at all, Dayanim warns.

Finally, if you can hire a third party to conduct periodic security assessments and vulnerability testing, security experts say that will go a long way toward convincing regulators, as well as dissuading lawyers from filing charges.