TJX's stolen data is being used - 200,000 accounts identified, so far

My guess is that the recent TJX data breach will prove to be the largest on record. Several sources are already reporting data from this breach is being used to commit fraud.

The Boston Globe is reporting:

The Massachusetts Bankers Association said yesterday that several banks reported fraud linked to debit and credit card numbers pilfered from TJX's computer system for unauthorized purchases made in Florida, Georgia, and Louisiana in the United States, and Hong Kong and Sweden overseas.

Middlesex Savings Bank is reissuing at least 20,000 Visa debit cards and had about a dozen suspected cases of fraudulent activity as far away as California and Japan, bank officials said. The bank said it costs at least $5 to replace a card, and many of the fraudulent charges were occurring at gas stations, discounters, grocery stores, and Internet merchants.

Boston Globe story, here.

This is likely the "tip of the iceberg" because a majority of the affected institutions haven't reported in yet.

Meanwhile up North, thousands of Canadian citizens have been affected. CTV is reporting:

Fraudulent activity has been confirmed on the accounts of thousands of Canadian credit-card holders who had their information stolen during a security breach at the U.S. parent company of Winners and HomeSense.

CTV story, here.

My advice is that if you have shopped at a TJX company recently - watch your statements, carefully.

Especially, if you have a debit-card. Debit cards aren't protected as well as credit cards. Tom Fragala (Truston Identity Theft Services) has a great post on his blog about this, here.

Tom developed this service from a victim's standpoint and has helped many victims, both personally and with his well-known commentary on the subject.

If you are a victim - I can personally recommend his services - which don't expose your personal information (again), also.

Here is my previous post on the TJX data breach:

TJX named as point-of-compromise in International …

Symantec warns of newsletters and "legitimate" advertising being hijacked!

Viagra with your Fantasy Football?

Spam is getting worse than ever, and a lot of spam filters don't seem to be stopping it. Even worse, legitimate mail is being designated as "spam" and placed in "bulk folders."

I find myself having to review my "bulk folder," daily.

Symantec is reporting a new "sneaky" spam tactic being seen out there. Legitimate newsletters and advertising from well known organizations, such as Walmart and ESPN are having ads for Viagra (example) inserted into their publications and sent out as if they are affiliated with the product.

In essence, the spammers are "hijacking" legitimate publications.

As reported in the Symantec Security Response blog by Kelly Conley:

We've noticed a tricky new spam tactic occurring recently and thought we'd share it with you. It’s always exciting when a new spamming technique comes along and it’s even more exciting when our filtering capabilities are successful against it. Most users running our product will not have seen this. Spam filtering can still protect you from this “new spam technique,” but, even if you have seen it or even opened it, you probably gave it a one-two glance and wondered “Eh? This isn't what I thought it was.”

The headers are legit – coming from a newsletter or ad that you have signed up for. You should be receiving this mail, right? Nope, it's a spam email. Look closer. There at the top of the page. It's an ad for something entirely different than what you thought was going to be in that email.

Kelly's full post, here.

Symantec's researchers have noted these "faux" (fake) images inserted on legitimate pages, or when the page is accessed - a "pop in" spam message appears moments later. They've also noted that the spammers seem to be able to control how many messages are sent out. No more than one a day is sent to any particular e-mail address -- and a different legitimate newsletter, or retailer is used each time.

According to the researchers, the motivation behind this is to (probably) make the reader more likely to read the message (believe it's credible). This method is possibly also used to in an attempt to trick a lot of the spam filters out there.

The good news is that - according to Kelly - Symantec's filters appear to be catching almost all of this.

A lot of us laugh at spammers and their "seemingly ridiculous" advertising, but the sad truth is, they wouldn't be sending it out if unless some people were falling for it. And that person might be one of your grandparents, or "younger relatives."

Even worse, the products they are "hawking" are questionable and in some instances, dangerous. In addition to this, spam is also used as a means to hook "victims" into all the various Internet scams that I frequently write about.

Symantec covers this issue "online fraud" (and others) on their blog, here.

Screenshot (below) of Kohl's ad being hijacked to sell drugs

Small Businesses are often the victims of financial misdeeds

Large businesses often employ dedicated experts to protect their assets. Unfortunately, smaller business can't afford these resources, and therefore are more vulnerable to fraud losses.

And it's easier for these larger businesses to write-off their fraud losses. The sad truth is that - if not managed properly - fraud losses can put a smaller business "out of business."

The Association of Certified Fraud Examiners noted in the 2006 report to the nation that small businesses seem to suffer "disproportionate fraud losses," when compared to larger organizations.

I did a previous post, which links to the report, here.

I read an interesting article by Lena West (CEO of xynoMedia Technology) that offers some practical advice to small businesses.

Ms. West writes:

It is officially open-season on small businesses. Hackers, phishers, spammers and fraudsters often use small businesses as target practice before going after the big guys, though it's news that often doesn't make it in the headlines. No one really knows the true impact of online security breaches, as only 20 percent of businesses reported computer intrusions to legal authorities, according to the FBI and Computer Security Institute. And every online merchant knows the threat of bogus credit card purchases is one that never goes away.

Full story from e-commerceguide.com, here.

The story points on how to deal with and protect yourself from everything from data-breaches to credit/debit card chargebacks.

Since in my opinion (awareness is the best and most effective fraud tool) - this article is great information for anyone, who owns a smaller business.

People are getting tired of having their personal and financial information stolen

Are people beginning to get sick and tired of discovering that their personal and financial information has been exposed?

Employees at Xerox are picketing their office in Oregon because it took four months for anyone to be notified that a Human Resource's Manager lost a laptop with their personal information on it.

Many of the employees (rightfully feel) that an offer of "free credit monitoring services" is coming four months too late, and are wondering why their information was stored on a laptop?

KOIN 6 News story, here.

With the news that TJX has potentially exposed millions in several countries by having their systems hacked, we are likely to see more and more people speak out!

Of course, we could ask Martha Coakley, who was just sworn in as the Attorney General in state of Massachusetts. Ms. Coakley recently discovered someone was trying to use her credit card to buy a Dell. Her comment was that the chances of catching the crook "are slim to none, since even if they could link it to a person, jurisdictional issues would likely hamper an effort to prosecute."

Boston Herald story, here.

Maybe the problem is that there aren't sufficient laws to protect people's (personal and financial) information, or go after the people - who steal it?