It'll Never Happen To Us

There's a part of human behavior that when we hear of something really bad happening, we compartmentalize and rationalize along the lines of "gee, that's really bad, I guess we're lucky".

What follows below is an excerpt from a recent 10Q submitted by TJX, who (as you might know) who was unfortunate to be targeted by very sophisticated information theives.

They're not bad guys over at TJX.  They run their shop pretty much like most retailers run their shops.  They don't deserve what happened to them in any regard.  I think that this could have just as easily happened to any of the IT organizations I meet every day.

As you read this, remember, the consequences of this theft have only just begun.   

And, if any good will come from this at all (other than lawyers making a lot of money) it will serve as an object lesson around just how important (and dangerous) information has become for all of us.

Now, imagine this was your company ... [Note: thanks to Bill Bonin who sent this along]

from the 10Q ...

------

PART II — OTHER INFORMATION

Item 1. Legal Proceedings

Computer Intrusion Litigation.

As discussed in TJX’s Form 10-K for fiscal 2007, putative class actions have been filed against TJX in state and federal courts in Alabama, California, Illinois, Massachusetts, Michigan, Ohio and Puerto Rico, and in provincial Canadian courts in Alberta, British Columbia, Manitoba, Ontario, Quebec and Saskatchewan, putatively on behalf of customers, including all customers in the United States, Puerto Rico and Canada, whose transaction data were allegedly compromised by the Computer Intrusion, and putative class actions have also been filed against TJX in federal court in Massachusetts putatively on behalf of all financial institutions which issued credit and debit cards purportedly used at TJX stores during the period of the Computer Intrusion. The actions assert claims, generally, for negligence and related common-law and/or statutory causes of action stemming from the Computer Intrusion, and seek various forms of relief including damages, related injunctive or equitable remedies, multiple or punitive damages, and attorneys’ fees. In addition to the actions referenced in TJX’s Form 10-K for fiscal 2007, the following actions and consolidated complaints have been filed:

On April 17, 2007, a putative class action was filed in the United States District Court for the Northern District of Illinois, Robinson v. TJX Companies, Inc., et al., 07-cv-02139. The plaintiffs purport to represent a class of all persons and entities in the United States and Canada who entered into credit or debit card transactions, or any other transaction which involved the transmission of personal and/or financial information, with TJX whose personal and/or financial information was stored in defendants’ databases and/or computer systems during the time-period that security was compromised. The complaint asserts a claim for negligence, and also names Fifth Third Bancorp as a defendant. Plaintiff seeks compensatory damages, injunctive relief, credit monitoring, attorneys’ fees and costs.

On April 18, 2007, a putative class action was filed in the United States District Court for the District of Massachusetts, Arians, et al. v. TJX Companies, Inc., et al., 07-cv-10754. The plaintiffs purport to represent a class of all TJX customers who made credit and debit card transactions at TJX’s stores during the period that the security of defendant’s computer systems was compromised and the privacy or security of whose credit card, check card, or debit card account, transaction, or non-public information was compromised. The complaint asserts claims for negligence per se, negligence, breach of contract and bailment, and also names Fifth Third Bancorp as a defendant. The plaintiffs seek compensatory damages, injunctive relief, credit monitoring, attorneys’ fees and costs.

On April 20, 2007, a putative class action was filed in the United States District Court for the District of Massachusetts, Mascolo-Brown, et al. v. TJX Companies, Inc., et al., 07-cv-10769. The plaintiffs purport to represent a class of all TJX customers who made credit and debit card transactions at TJX’s stores during the period that the security of defendant’s computer systems was compromised and the privacy or security of whose credit card, check card, or debit card account, transaction, or non-public information was compromised. The complaint asserts claims for negligence per se, negligence, breach of contract and bailment, and also names Fifth Third Bancorp as a defendant. The plaintiffs seek compensatory damages, injunctive relief, credit monitoring, attorneys’ fees and costs.

On April 25, 2007, a putative class action was filed against TJX in the United States District Court for the District of Massachusetts, Massachusetts Bankers Association, et al. v. TJX Companies, Inc., 07-cv-10791. The plaintiffs purport to represent a class of financial institutions that have suffered damages and/or harm as a result of data breaches with respect to personal and financial information of customers who used debit or credit cards at TJX’s retail stores. The complaint asserts claims for negligent misrepresentation, violations of Massachusetts General Laws, c. 93A, § 11, negligence and breach of contract. Plaintiffs seek compensatory damages, treble damages with respect to the statutory violation claim, injunctive relief, attorneys’ fees, costs and interest.

On April 30, 2007, a putative class action was filed in the United States District Court for the Western District of Michigan, Wardrop v. TJX Companies, Inc., 07-cv-00430. The plaintiff purports to represent a class of all persons whose personal, financial and/or transaction data was accessed by unauthorized persons while in the possession, custody or control of TJX. The complaint asserts claims for negligence, breach of contract and bailment. The plaintiff seeks compensatory damages, injunctive relief, a fund to compensate future damages, credit monitoring, attorneys’ fees, interest and costs.

On May 17, 2007, a putative class action was filed in the United States District Court for the Southern District of Ohio, Taliaferro, et al. v. TJX Companies, Inc., et al., 07-cv-00388. The plaintiffs purport to represent a class of all TJX customers who made credit and debit card transactions at TJX’s stores during the period that the security of defendants’ computer systems was compromised and the privacy or security of whose credit card, check card, or debit card account, transaction, or non-public information was compromised. The complaint asserts claims for negligence, negligence per se, breach of contract and bailment, and also names Fifth Third Bancorp as a defendant. The plaintiff seeks compensatory damages, injunctive relief, credit monitoring, attorneys’ fees and costs.

On May 23, 2007, a putative class action was filed in the United States District Court for the Eastern District of Texas, Lack, et al. v. TJX Companies, Inc., et al., 07-cv-00233. The plaintiffs purport to represent a class of themselves and all other similarly situated persons and entities in Texas who had sensitive personal information stolen and/or compromised as a result of the TJX breach. The complaint asserts claims for violations of the Texas Identity Theft Enforcement and Protection Act, breach of fiduciary duty, negligence, negligence per se, breach of contract and bailment, and also names Fifth Third Bancorp as a defendant. The plaintiffs seek compensatory damages, attorneys’ fees, interest and costs.

On May 23, 2007, a putative class action was filed in the United States District Court for the Western District of Missouri, Lamb. v. TJX Companies, Inc., et al., 07-cv-00379. The plaintiff purports to represent a class of all persons or entities in Missouri who entered into credit or debit card transactions, or any other transaction which involved the transmission of personal and/or financial information, with TJX whose personal and/or financial information was stored in defendants’ databases and/or computer systems during the time-period that security was compromised. The complaint asserts a claim for negligence, and also names Fifth Third Bancorp as a defendant. The plaintiff seeks credit monitoring, injunctive relief, compensatory damages, attorneys’ fees and costs.

On May 23, 2007, a putative class action was filed in the United States District Court for the Northern District of Illinois, Roberts v. TJX Companies, Inc., et al., 07-cv-02887. The plaintiff purports to represent a class of all other similarly situated persons or entities in Illinois who had sensitive personal information stolen and/or compromised as a result of the TJX breach. The complaint asserts claims for breach of fiduciary duty, negligence, negligence per se, breach of contract and bailment, and also names Fifth Third Bancorp as a defendant. The plaintiff seeks compensatory damages, attorneys’ fees, interest and costs.

Mace

v. TJX Companies, Inc. pending in the United States District Court for the District of Massachusetts has been administratively designated as the lead case with respect to all actions pending in the District of Massachusetts, which have been consolidated. In those consolidated proceedings, a consolidated customer complaint naming TJX and Fifth Third Bancorp as defendants was filed on May 9, 2007, in which several named customer plaintiffs purport to represent a class of all persons or entities in the United States who shopped at TJX’s stores in the United States, made a purchase or return, have had personal or financial data stolen or compromised from TJX’s computer systems, and who were damaged thereby. The consolidated customer complaint asserts claims for negligence, breach of contract, breach of implied contract, and violations of Massachusetts Gen. Laws ch. 93A, §§9 and 11 and seeks compensatory damages, treble damages as to the statutory violation claim, injunctive relief, attorneys’ fees, interest and costs. In addition, a consolidated financial institution complaint against TJX as a defendant was filed in these consolidated proceedings on May 23, 2007, in which several named financial institution plaintiffs purport to represent a class of financial institutions that have suffered damages and/or harm as a result of data breaches set forth herein with respect to personal and financial information of customers who used debit or credit cards at TJX’s retail stores. The consolidated financial institution complaint against TJX asserts claims for negligent misrepresentation, violations of Massachusetts General Laws, c. 93A, §11, negligence and breach of contract and seeks compensatory damages, treble damages with respect to the statutory violation claim, injunctive relief, attorneys’ fees, interest and costs. A separate consolidated financial institution complaint was also filed in these consolidated proceedings on May 23, 2007 asserting claims against Fifth Third Bancorp and Fifth Third Bank.

The Arkansas Carpenters Pension Fund, the purported beneficial holder of 4,500 shares of TJX common stock, commenced an action in the Delaware Chancery Court, New Castle County, No. 2806, under Section 220 of the Delaware General Corporation Law demanding to inspect certain of TJX’s books and records relating to the Computer Intrusion and TJX’s response to the Computer Intrusion. As relief, the Arkansas Carpenters Pension Fund seeks the right to inspect records dating back to 2003, as well as its attorneys’ fees and costs.

TJX intends to defend all of these actions vigorously.

Government Investigations. As discussed in TJX’s Form 10-K for fiscal 2007, a number of government agencies are conducting investigations as to whether TJX as a result of the Computer Intrusion may have violated laws regarding consumer protection and related matters. Thirty-seven state Attorneys General are participating in the multi-state Attorneys General investigation, and TJX has received nearly identical civil investigative demands or subpoenas from eleven of these Attorneys General.

TJX has been cooperating in each of the government investigations.

Other Litigation.

Putative class actions have been filed against TJX for alleged willful violations of 15 U.S.C. § 1681c(g) based upon the alleged electronic printing at certain T.J. Maxx and Marshalls stores of customer receipts bearing more than the last five digits of the customers’ credit or debit card number and/or the expiration date of the credit or debit card. The complaints seek statutory damages of not less than $100 and not more than $1,000 for each violation, punitive damages, and costs and attorneys’ fees. The actions are Clark v. Marshalls of MA, Inc., The TJX Companies, Inc. and Marshalls of CA, LLC (Case No. 2:06-CV-08135-ABC-(SHx)) (filed in the United States District Court, Central District of California, on December 20, 2006); Bersekian v. TJ Maxx of CA, LLC, and the TJX Companies, Inc. (Case No. 2:07-CV-00503-R-(JWJ) filed in the United States District Court, Central District of California, on January 19, 2007); Tolley-McNerney v. TJX Companies, Inc., dba T.J. Maxx and Marshalls (Case No. 3:07-CV-0091-ECR-(RAM) filed in the United States District Court, District of Nevada, on February 27, 2007); Ramirez v. The TJX Companies (Case No. 2:07-CV-2115-KHV-(DJW) filed in the United States District Court, District of Kansas, on March 16, 2007); Mendez v. The TJX Companies, Inc. (Case No. 1:07-cv-02486 filed in the United States District Court, District of Illinois, on May 3, 2007); Caranci v. Marshalls of MA, Inc., and TJX Companies, Inc. (Case No. 1:07-CV-00173-ML-(DLM) filed in the United States District Court, District of Rhode Island, on May 16, 2007) and Ivanova v. TJX Companies Inc., dba Marshall’s and Marshall’s of MA Inc., dba Marshall’s (Case No. 07c 3082 filed in the United States District Court, Northern District of Illinois on June 1, 2007).

TJX filed a motion with the Judicial Panel on Multidistrict Litigation, MDL Docket No. 1853, to have the actions transferred for consolidated pre-trial proceedings to the United States District Court for the District of Kansas — Kansas City. Three plaintiffs requested that the actions be transferred to the United States District Court, Central District of California. TJX intends to defend all of these actions vigorously.

Comments

[Chris M Evans]

Chuck, whilst I sympathise with your views that the people may not be maliciously losing data, I would question the "data guardians" to ask exactly why TJX feel they need to retain the full credit cards of their customers on file for so long? Surely they should have a robust data deletion policy for data classed as risky but no longer needed.

[Chuck Hollis]

Hi Chris -- fair point. And one has to wonder how many organizations have our personal details lying around longer than necessary?

I do not know the full details behind the TJX case, but what I have seen indicates a sophisticated network-based penetration, installation of modified programs on systems, and over a long period of time. Maybe they had inside help.

But it doesn't sound like a case of someone making a copy of a few files, or knicking a backup tape. They were hit by a team, and it sounds like quite a caper.

Thanks for commenting!

[Bob D]

Good point about companies keeping your information around. I recently bought a car from a major Dealer and the dealer wanted my SS#. (I wasn't taking out a loan from him)

I looked at the floor under the desk where a network switch was located and said "NO WAY" are you getting my SS#.

If their network switch (it was linksys) is on the floor under a desk I sincerely doubt that they encrypt their data or do anything to keep my information safe.

This is a huge problem for small businesses everywhere.

It's worth suing TJ Max for millions but not the local car dealer. Yet, I'd be willing to bet a lot of my own money that TJ Max does a lot better job of protecting my data than the local car dealer.

[Chuck Hollis]

Good point.

I was over in Europe this week talking to customers, and this topic came up. It was clear that I thought this was a much bigger deal than they did.

The European view is very different than ours.

As one person said simply: "life is dangerous".

Kind of made me think -- how much of our concern is cultural vs. pragmatic?

[Fred333]

Great post. Lots of great information.