Target CIO Beth Jacob has apparently fallen on her sword in the wake of the massive security breach in mid-December that compromised 40 million debit and credit cards and swept national headlines. Her resignation was rendered this week effective immediately.
Fair or not, Jacob’s resignation wasn’t entirely surprising.
“If you look at the history of other large data breaches, turnover at the top of the IT shop is not unusual,” says retail IT consultant Cathy Hotka.
Target CEO Gregg Steinhafel says the retailer is now looking outside the company for a CIO to succeed Jacob and help overhaul its network security, according to the Wall Street Journal.
Ironically, Jacob, who has a sterling reputation among retail CIOs, was thought of as a great hire by Target in 2008, Hotka says.
“If you went up to a bunch of retail CIOs and asked them, ‘Could this have happened to you?’ the answer would be, yes.”
— Cathy Hotka
Target’s security incident — from the breach to Steinhafel penning a mea culpa open letter to Target customers to running apologetic ads in the Wall Street Journal and other major publications to Jacob’s resignation — is a watershed moment for retail CIOs. They are now faced with rethinking their data security strategy.
The kind of breach that occurred at Target was highly sophisticated. Hackers slipped their software into Target’s computer systems via credentials stolen from one of Target’s vendors, reported the Wall Street Journal. The software eventually made its way to checkout stations and began amassing credit card data.
Did Target’s CIO Stand a Chance?
“The people who are responsible for these kinds of breaches are well-organized, criminal enterprises,” Hotka says. “If you went up to a bunch of retail CIOs and asked them, ‘Could this have happened to you?’ the answer would be, yes.”
CIOs are put in a tough spot because they’re not given adequate security funding, Hotka says. She recalls five years ago when the CIO of apparel and home fashions retailer TJX Companies had asked for additional data security resources and didn’t get them. A massive security breach followed, compromising millions of credit card numbers. TJX Companies agreed to pay $40.9 million to resolve potential claims by banks.
Given the growing sophistication of attacks, retail CIOs must now reconsider whether or not managing the risk in-house is wise. As Jacob’s resignation shows, a retail CIO is culpable yet might not have the know-how or resources to protect the company.
So should retail CIOs outsource data security to the experts?
“I think at this stage it’s not unreasonable,” Hotka says.
Tom Kaneshige has been covering business and technology in Silicon Valley for two decades. As senior online writer at CIO.com, Tom covers Silicon Valley culture, BYOD and consumer tech in the enterprise.