Intellectual Property Law

The Register's Dan Goodin is reporting that a TJX employee was fired last Wednesday after posting messages to an online forum disclosing that TJX has not improved security since it suffered a massive data breach in which the credit card information of 94 million customers was stolen.

The employee, Nick Benson, who worked at a TJ Maxx outlet in Lawrence, Kansas (which is owned by TJX), wrote that earlier this month the manager at his store changed the log-in protocol so that employees were able to log onto company servers using blank passwords.

The employee noted that when he first started working for TJ Maxx in October 2005, his password was the same as his user name. But after the company became aware in January 2007 that hackers had been stealing credit card information from its database for 17 months, the company changed its log-in policies, requiring employees to use stronger passwords. But earlier this month managers at his store negated those security measures by changing the log-in protocol to accept blank passwords.

He also says the store server was running in administrator mode, making it easy for hackers -- or store employees -- to have escalated privileges on the system once they entered it.

Benson, a 23-year-old freshman at the University of Kansas, told the Register that he discussed his security concerns with store managers but says they were unresponsive.

"I was basically hitting a glass wall," said Benson. "Not one single thing was done. My store manager even posted the password and username on a post-it note. I told her not to do that."

So Benson posted his complaints anonymously to a computer security site called Sla.ckers.org under the nickname CrYpTiC_MauleR. TJX told Benson that it became aware of his postings from a firm that it hired to scour the internet for anything mentioning TJX. Benson was fired for disclosing confidential information about the company.

See also:

• TJX Failed to Notice Thieves Moving 80-GBytes of Data on its Network
• Data Breach Will Cost TJX $1.7B, Security Firm Estimates
• Boeing Employee Fired for Discussing Computer Security Problems at ...
• Student Journalist Punished by University After Reporting On Its ...