Quantcast StorefrontBacktalk » Blog Archive » J.C. Penney, Target Added To List Of Gonzalez Retail Victims
advertisement
advertisement

J.C. Penney, Target Added To List Of Gonzalez Retail Victims

Written by Evan Schuman
August 27th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Albert Gonzalez, who has been accused of managing the data breaches at TJX, Hannaford, 7-Eleven and Heartland (among many others), has once again agreed to plead guilty to parts of two of the three federal cases against him, his attorney, Rene Palomino, said Thursday (Aug. 27). Two other major retail names have also been added to the list of retail victims: J.C. Penney and Target, as the list of unidentified retailers shrinks.

Look for Gonzalez to officially plead guilty to the federal charges from Boston, primarily involving TJX, BJ’s Wholesale Club, Boston Market and Sports Authority and New York, primarily involving Dave & Buster’s, on Sept. 11.

This is at least the second time that Gonzalez has danced this particular dance, as he was all set to plead guilty to those Boston and New York charges—or at least a substantial subset of them—but that deal was killed when, according to Palomino, the U.S. Attorney’s Office in Newark accelerated their indictment. Palomino said this new deal does not include any of the Newark charges, but that “Newark has the opportunity to come into it eventually, if they like.”

Target was one of—if not the only—unidentified major retailer in the Boston case, stemming from a series of Florida wireless drive-bys involving Gonzalez, Palomino said. J.C. Penney was one of the unidentified retail victims in the Newark indictment.

Target and J.C. Penney have plenty of company in this mass of federal cyber thief charges. Beyond TJX, BJ’s, Boston Market, Sports Authority, Dave & Buster’s, TJX, Hannaford, 7-Eleven and Heartland, their fellow hacking victims include Office Max, Barnes & Noble, Sports Authority, Forever 21 and DSW.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...