Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Mass. bill would put data breach responsibilities on retailers

By Michael Cooney , Network World , 02/23/2007
  • Share/Email
  • Comment
  • Print

In the face of a massive data security breach by one of the state’s largest companies, TJX, Massachusetts lawmakers are set to look at a bill that would make companies liable when their security systems are hacked and credit card data or personal information is stolen.

According to reports, the law would be one of the first of its kind in the United States, forcing retailers and other companies along with government agencies and nonprofit groups to pay for losses if financial data is stolen, said state Rep. Michael Costello (D), in a statement.

According a Wall St. Journal article today, the proposal in Massachusetts would: "require companies whose security systems are breached to assume full financial responsibility for any fraud-related losses, costs associated with the canceling and reissuing of cards, and -- in cases of identity theft -- the freezing of accounts and credit information. The bill would apply to any company doing business in Massachusetts, wherever it may be based."

Some 30 states have laws that require companies to notify customers immediately when data breaches occur, though most of the statutes let companies delay notification while law enforcement agencies investigate, experts say.

Proponents hope the Massachusetts law would prompt retailers to invest more heavily in security technology and trigger other states to pass similar legislation. Banks, who absorb most of the nefarious charges when these data breaches occur would also like to see such bills. U.S. House Financial Services Committee Chairman Barney Frank, a Massachusetts Democrat, said in a Reuters report he is drafting a similar provision for a federal bill that he expects to introduce to Congress in the next month or two.

And as for TJX, the news just keeps getting worse: An ongoing investigation of the breach has shown that intruders gained access to TJX systems almost a full-year earlier than first revealed by TJX -- and compromised more payment card data than previously believed, the company said. In addition, TJX confirmed that transaction data involving TJX-owned stores in the United Kingdom and Ireland were also affected by the intrusion.

The retailer still hasn’t said how many customers have been affected by the break-in, but published reports have stated the breach last month compromised tens of millions of credit and debit cards. In addition Massachusetts Attorney General Martha Coakley will lead a civil investigation by dozens of states into the security breach disclosed last month by The TJX Companies, the owner of T.J. Maxx and Marshalls retailers.

  • Share/Email
  • Comment
  • Print
Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed