Senate investigators accused Target on Tuesday of making serious missteps that allowed hackers to steal millions of credit card numbers from its system.
Target “missed a number of opportunities”¦ to stop the attackers and prevent the massive data breach,” the Senate Commerce Committee aides wrote in a report.
The findings could expose Target to a lawsuit from the Federal Trade Commission, which has sued dozens of companies in recent years for failing to adequately protect customer data from hackers.
Molly Snyder, a Target spokeswoman, said the company’s investigation is ongoing.
“With the benefit of hindsight, we are investigating whether, if different judgments had been made the outcome may have been different,” she said.
The hackers stole credit card numbers for as many as 40 million Target customers between Nov. 27 and Dec. 15 of last year, according to the retailer. The hackers obtained other personal information such as names and addresses for another estimated 70 million customers.
The report comes ahead of Wednesday’s Senate Commerce Committee hearing which will feature testimony from John Mulligan, Target’s chief financial officer, and FTC Chairwoman Edith Ramirez.
The report details how the hackers breached Target’s system and identifies numerous points where Target could have prevent the theft of its customers’ data.
Target gave access to its network to a small Pennsylvania heating and air conditioning vendor, Fazio Mechanical Services, which had “weak security,” according to the report.
The hackers used malware to infiltrate the vendor and then used the vendor’s credentials to access Target’s system, the investors found. Even then, Target could have disrupted the hack if it responded to its internal alerts.
“Target appears to have failed to respond to multiple warnings from the company’s anti-intrusion software regarding the escape routes the attackers planned to use to exfiltrate data from Target’s network,” the Senate aides wrote.
In public financial filings, Target has acknowledged that it is under investigation by the FTC and state attorneys general over the breach.
Senate Commerce Committee Chairman Jay Rockefeller is pushing legislation that would expand the FTC’s ability to crack down on companies for inadequate data security. His bill, the Data Security and Breach Notification Act, would give the FTC the authority to set data security rules and the power to fine companies for violations.
The legislation would also set a national standard requiring companies to notify customers in the event of a breach.
“While Congress deserves its share of the blame for inaction, I am increasingly frustrated by industry’s disingenuous attempts at negotiations,” the West Virginia Democrat said in a statement. “It’s time for industry to work with us on legislation that reinforces the basic protections American consumers have a right to count on.”
What We're Following See More »
The Senate voted on Wednesday 72-26 on a bill to fund the government through Dec. 9, averting a looming shutdown. The legislation will now go to the House, where it could be voted on as early as Wednesday. After this legislation is approved by the House, Congress will recess until the lame-duck session following elections.
"Congress voted Wednesday to override President Obama for the first time in his eight-year tenure, as the House followed the Senate in rejecting a veto of legislation allowing families of terrorist victims to sue Saudi Arabia. The House easily cleared the two-thirds threshold to push back against the veto. The final tally was 348-77, with 18 Republicans and 59 Democrats voting no."
Hyperbole alert! Following the Senate's decision to override President Obama's veto of a bill that would allow 9/11 victims to sue Saudi Arabia in U.S. court, the White House has responded forcefully, specifically White House Press Secretary Josh Earnest. "I would venture to say that this is the single most embarrassing thing that the United States Senate has done, possibly, since 1983," Earnest said on Air Force One. The House is likely to follow suit in overriding Obama's veto when it takes up the vote.
Two weeks after a massive stroke, Nobel Peace Prize winner and former president and prime minister of Israel Shimon Peres passed away late Tuesday night. In a political, military, and diplomatic career that lasted nearly 70 years, Peres was influential both in building up the formidable strength of the Israeli military and in seeking to negotiate lasting peace with Israel's many neighboring Arab countries. Within hours of the announcement of his death, both condolences and tributes began pouring in, including from former President Bill Clinton, Speaker of the House Paul Ryan, and former United Kingdom Prime Minister Tony Blair.