Banks lob sueball at Trustwave, Target over breach
'Round-the-clock monitoring' spun out, missed vulnerabilities
A group of banks has filed a class action lawsuit against Target over its recent data breach, and has named security company Trustwave as a co-defendant.
Trustwave is being targeted because, according to the banks, vulnerabilities in Target's systems remained “either undetected or ignored” in audits as recently as September 2013. These vulnerabilities included the fact that Target stored “credit and debit card data on its servers for six full days before hackers transmitted the data to a separate webserver outside of Target's network”.
Moreover, the filing claims, the Target breach went undetected for three weeks, even though the company “provided round-the-clock monitoring services to Target”.
It's against Target, however, that the most serious allegations are levelled. The class action led by Trustmark National Bank and Green Bank, say the retailer should not have allowed an outside contractor the access to its network that brought about the breach, and that it violated federal and state laws in storing the credit card data on its network.
Moreover, the lawsuit notes, repeated warnings and breaches stretching back to 2007 should have left Target in no doubt that vulnerabilities existed.
The suit cites America's Consumer Banking Association as estimating that the direct costs to banks have already reached $US172 million in re-issuing cards alone, with perhaps $US1 billion in the longer-term costs of fraudulent transactions resulting from the breach. ®
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Trusted Platform Module
- Zero trust