[ISN] TJX data theft doesn't deter bargain shoppers

From: InfoSec News (alerts@private)
Date: Sun Apr 15 2007 - 22:26:10 PDT


http://www.ohio.com/mld/beaconjournal/business/17077991.htm

By Mark Jewell
Associated Press
April 14, 2007

BOSTON - Bargain shopping appears to be trumping fears about data theft 
at TJX Cos., owner of nearly 2,500 discount stores that are enjoying 
brisk sales despite a security breach that exposed at least 45.7 million 
credit and debit cards to potential fraud.

TJX reported that sales at stores open at least a year rose 6 percent in 
March, beating Wall Street's expectations. The performance extended a 
recent run of sales gains since TJX three months ago announced a breach 
now known to be the nation's biggest data theft.

Customers leaving a T.J. Maxx store in Boston on Thursday said the 
retailer's cut-rate prices on clothing and home goods are a big enough 
draw to offset any worries about lax data security. They said they don't 
see TJX as any more susceptible to such theft than any other retailer.

``It's a sad thing, but it can happen anywhere,'' said Chamia Kissoon, a 
30-year-old bank employee from Boston who left with a bag filled with 
clothing.

``Identity theft and data theft seem endemic, and I've got to presume 
that since TJX is aware of this theft, that they've fixed their problem 
here,'' said Peter Hartzel, a 60-year-old financial manager from Dedham, 
Mass.

An expert who helps corporate clients repair their reputations said he 
was not surprised by TJX's strong sales amid bad publicity.

``Convenience and price are huge factors in bringing people to any 
store,'' said Peter Morrissey, an associate professor of communications 
at Boston University who helped advise Johnson & Johnson after product 
tampering in 1982 involving its medication Tylenol. ``It's just hard to 
change people's patterns.''

``And with something as mysterious as a data breach, it seems to be 
remote, and beyond people's control, so customers cut you a fair amount 
of slack,'' Morrissey said. ``It's almost like white noise.''


News doesn't hurt sales

TJX's 6 percent increase in same-store sales in the five weeks through 
April 7 beat expectations of industry analysts polled by the research 
firm Thomson Financial. They had forecast an increase of 4.6 percent at 
TJX, whose stores are T.J. Maxx, Marshalls, HomeGoods and A.J. Wright in 
the United States, Winners and HomeSense in Canada and T.K. Maxx in 
Britain.

TJX reported a 2 percent same-store gain in February and a 4 percent 
gain in January. Same-store sales are a key measure of retailer 
performance because they measure growth at existing stores rather than 
from new ones.

TJX's sales have risen even as the company has acknowledged the breach 
was worse than first thought. On Feb. 21, TJX said the breach of its 
computer systems by an unknown hacker or hackers had started 10 months 
earlier than initially believed, beginning in July 2005.

On March 28, TJX for the first time put a number on how many of its 
shoppers' cards had been compromised: at least 45.7 million. The Privacy 
Rights Clearinghouse, a consumer advocacy group that tracks data thefts, 
ranks the theft at TJX as the largest such U.S. breach.

The company and the Secret Service are investigating, and the company 
has said it remains unsure how many people were involved in the breach, 
or whether anyone inside the company may have played a role. The only 
arrests have come in Florida, where 10 people who aren't believed to be 
the TJX hackers are accused of using stolen TJX customer data to buy 
Wal-Mart gift cards.

But the more than 50 experts TJX put on the case have reached no 
conclusions. Besides not knowing how many thieves were involved, TJX 
isn't sure whether there was one continuing intrusion or separate 
break-ins, according to a March 28 regulatory filing.


Estimating losses

The company says it's too early to estimate its losses beyond the $5 
million it spent through January to cover expenses such as legal and 
investigative costs, and letters sent to customers who may have been 
exposed to fraud.

Banks nationwide have reissued debit and credit cards to guard against 
further fraud. TJX also faces lawsuits from consumers and financial 
institutions, and potential fines from government investigations.

TJX's stock has fallen only slightly through the ordeal.

``Wall Street is very focused on their operating performance, and on how 
this credit card issue is something that will be corrected, and then it 
will be history,'' said Mark Montagna, an industry analyst with C.L. 
King & Associates.

As for customers, Patrick McKeever, an analyst with Avondale Partners, 
said surveys that he and others in his firm have conducted with TJX 
shoppers indicate that any consumer backlash will be negligible.

``There were certainly a few people who had heard about it on the news 
and decided to curtail their shopping at TJX, but for the most part, 
people seemed not to be overly concerned about it,'' McKeever said. 
``Consumers are well aware of the kind of value TJX offers because you 
can go and see the same merchandise you would see in department stores, 
and it's 20 to 60 percent cheaper. It's very compelling at the end of 
the day.''


__________________________
Subscribe to InfoSec News
http://www.infosecnews.org



This archive was generated by hypermail 2.1.3 : Sun Apr 15 2007 - 22:39:02 PDT