Case Study: Attack on TJX Companies (2005–2007)

[Professor]

Below is an in-depth, educational look at one of the largest and most historically significant cyber attacks in the retail industry, the TJX Companies attack (2005–2007).

This incident is considered the first “super breach” of data, which changed the approach to cybersecurity in the financial and retail industries. It became the catalyst for the development of PCI DSS, stricter encryption requirements, and awareness of the threats associated with wireless networks and data storage.

Case Study: Attack on TJX Companies (2005–2007)​

An Educational Analysis of the First "Super Leak" in Retail History​

Attack period: May 2005 – December 2006 (discovered in January 2007 )
Victim: TJX Companies – parent company of retailers:

• T.J. Maxx
• Marshalls
• HomeGoods
• Winners (Canada)
  Extent of the leak:
• 45.7 million records with bank card data
• 455,000 receipt records (including driver's licenses)
  Damages: > $256 million (estimated) - fines, lawsuits, system upgrades
  Attack type: Long-term APT attack using weak Wi-Fi security, unencrypted data, and outdated software

1. General attack scheme​

[1] Hacking Wi-Fi in a store (WEP) → [2] Accessing the internal network → [3] Finding servers with data → [4] Mass data theft → [5] Extraction via external servers

The attack lasted over 18 months, and TJX didn't even know about it until the data started appearing on black markets.

2. Stage 1: Entry Vector - Weak Wi-Fi Security​

Place of entry: store in Minneapolis, USA​

• TJX used wireless access points to transmit data between cash registers and servers.
• Security protocol: WEP (Wired Equivalent Privacy) - already outdated and easily hacked by 2005.

How the attack happened:​

1. The attackers (later identified as a group associated with Albert Gonzalez) connected to the Wi-Fi from the store's parking lot.
2. Used Aircrack-ng to crack WEP in less than 1 hour.
3. We gained access to the store's internal network, and then to the TJX corporate network.

Error:

• Using WEP instead of WPA2.
• No segmentation - Wi-Fi provided access to critical systems.

3. Stage 2: Network Movement and Privilege Escalation​

What the attackers did:​

• Conducted a network scan (Nmap-like actions).
• Found a centralized transaction processing server in Hopkinton, Massachusetts.
• FTP servers were discovered that stored unencrypted transaction data.
• Gained access to database backups.

The attackers used legitimate accounts found in logs and remote access tools (RAT).

4. Step 3: Search and steal data​

What was stolen:​

DATA TYPE	VOLUME	DANGER
PAN (card number)	45.7 million	For cloning and CNP fraud
Validity period	45.7 million
Holder name	45.7 million
Check details	455 000	Including driver's license numbers - for identity theft
PIN codes (partially)	No	But they were stored in encrypted form (3DES), but with a vulnerable key

Key Error:
TJX stored card and receipt data for more than 1 year, although this is prohibited by law.

5. Step 4: Data Storage and Extraction​

Where was the data stored?​

• On FTP servers in open form.
• In backup copies, not encrypted.
• In transaction logs available through internal applications.

How did the data leak?​

• The attackers uploaded data to external FTP servers in the United States and abroad.
• Used fake accounts and proxies.
• Some of the data was sold through darknet forums and chats.

The breach lasted from May 2005 to December 2006, but was only discovered in January 2007, when banks reported a surge in fraud.

6. Why was the attack not detected?​

6.1 Lack of monitoring and DLP​

• No data leak detection systems (DLP).
• No SIEM, no alerts for bulk data transfer.

6.2 No encryption​

• PAN and check data were stored in clear text.
• No P2PE or DUKPT was used.
• Even PIN codes were encrypted using a weak key that could be recovered.

6.3. Legacy Technologies​

• WEP instead of WPA2.
• Windows 2000 / XP on servers.
• Outdated versions of databases (Oracle, SQL Server).

7. Consequences of the attack​

7.1 Financial and legal implications​

• Damage: >$256 million
  • $24 million - fine from Visa.
  • $40.9 million - settlement with Mastercard and banks.
  • $9.5 million - compensation to 41 US states.
  • $25 million – systems modernization.
  • $179 million - lawsuits, operating expenses.
• Dismissal of CIO and other top managers.
• Loss of customer trust.

7.2. Changes in the industry​

The Birth of PCI DSS​

• Before TJX, there was no single security standard for card processing.
• In 2004, PCI DSS v1.0 was released, but many companies ignored it.
• After TJX, PCI DSS became mandatory, and its requirements became stricter:
  • Prohibition of storage of card data.
  • Mandatory encryption.
  • Regular pentests.
  • Network segmentation.

P2PE development and tokenization​

• TJX has been a catalyst for the transition to Point-to-Point Encryption (P2PE).
• Growing interest in tokenization - replacing PAN with a token.

Understanding Wi-Fi Threats​

• Companies have started migrating Wi-Fi to WPA2-Enterprise, 802.1X, RADIUS.

8. Technical and organizational errors of TJX​

ERROR	CONSEQUENCES
Using WEP	Easy access to the network from the parking lot
No data encryption	PAN was stored in clear text
Long-term data storage	Violation of laws and PCI
No segmentation	Wi-Fi → servers → databases
No monitoring	1.5 year leak unnoticed
Outdated software	Vulnerabilities, no updates

9. How could the attack have been prevented?​

STAGE	PROTECTIVE MEASURE
Wi-Fi access	Use WPA2/WPA3 + 802.1X
Network security	Segmentation, VLAN, firewall
Data storage	Do not store PAN, use P2PE and tokenization
Monitoring	SIEM, DLP, EDR
Updates	Regular patches, no EOL systems
Politicians	PCI DSS compliance, staff training

10. Sources and documentation​

• Report FTC (Federal Trade Commission) — https://www.ftc.gov
• Court documents in Albert Gonzalez case - one of the main hackers, found guilty.
• KrebsOnSecurity - an investigation by Brian Krebs.
• PCI Security Standards Council - History of PCI DSS.
• MITRE ATT&CK:
  • T1190 – Exploit Public-Facing Application (Wi-Fi)
  • T1041 – Exfiltration Over C2 Channel
  • T1552 – Unsecured Credentials

Conclusion​

The TJX attack is a turning point in the history of cybersecurity:

• Showed that even large companies are vulnerable.
• Demonstrated the dangers of outdated technologies (WEP, data storage).
• Became a catalyst for PCI DSS and global improvement of security standards.

The main lesson:
Security is not an option, but a necessity.
Even a "minor" vulnerability (WEP) can lead to a disaster if there is no security culture, auditing and control.

Comparison with other cases​

PARAMETER	TJX (2005-2007)	TARGET (2013)	HOME DEPOT (2014)
Maps leak	45.7 million	40 million	56 million
Input vector	Wi-Fi (WEP)	Supplier (phishing)	Supplier (phishing)
Duration	18 months	3 weeks	5 months
Key mistake	Data storage, WEP	No segmentation, MFA	Ignore alerts, P2PE
Consequences	The Birth of PCI DSS	Tightening P2PE	EDR/SIEM Development

If you want, I can:

• Prepare an attack diagram using the Cyber Kill Chain model.
• Create a checklist to prevent such attacks.
• Show how to crack WEP (for educational purposes).
• Compare PCI DSS before and after TJX.

Write in which direction to go deeper!