* * * * * More + BigCharts + Virtual Stock Exchange + FiLife.com + WSJ Asia + WSJ Europe + WSJ Portuguese + WSJ Spanish + WSJ Chinese + Financial News Online ____________________ SEARCH * + Welcome, Logout + o My Account o My Online Journal o Help o Message Center ( new) * + Today's Paper + Video + Columns + Blogs + Graphics + Newsletters & Alerts + New! Journal Community Subscriber Log In Subscriber Log In User Name ____________________ Password ____________________ Log In [_] Remember me Forgot your password? * Home * U.S. * World * Business * Markets * Tech * Personal Finance * Life & Style * Opinion * Careers * Real Estate * Small Business * QUICK LINKS : * Wall Street Crisis * Campaign 2008 * Heard on the Street * Market Data * Management * Business Insight * WSJ. Magazine * Asia * Europe * Earnings * Economy * Health * Law * Management * Media & Marketing * expand More Industries up down + Accounting + Advertising + Airlines + Autos + Banking + Chemicals + Computer Hardware + Computer Software + Consumer Products + Defense & Aerospace + Energy + Broadcasting & Entertainment + Financial Services & Insurance + Food & Tobacco + Hospitality + Industrial Goods & Services + Internet + Marketing & Strategy + Media Agencies + Metals & Mining + Paper & Forest Products + Pharmaceutical & Biotech + Real Estate + Retail + Semiconductors + Telecom + Transportation + Utilities * Columns & Blogs * top stories in Business * 1 of 10 Goldman's Net Drops 70% * 2 of 10 Barclays Nears Lehman Deal * 3 of 10 New York Fed Injects Liquidity * 4 of 10 Inflation Eases on Oil Price Drops * 5 of 10 [Ken Lewis] BofA CEO Does Victory Lap * 6 of 10 [Lehman Brothers] Old-School Banks Emerge on Top * 7 of 10 Regulatory Revamp Likely to Widen * 8 of 10 [Two workers install a huge VW logo in the wall of a temporary Volkswagen center on Monday.] Volkswagen in Porsche's Hands * 9 of 10 Invesco Plans China Joint Venture * 10 of 10 KB Home's EX-CEO Settles Charges prev next + + + + + + + + + + + hide top storieshide top stories + show top storiesshow top stories + Dow Jones Reprints: This copy is for your personal, non-commercial use only. To order presentation-ready copies for distribution to your colleagues, clients or customers, use the Order Reprints tool at the bottom of any article or visit www.djreprints.com See a sample reprint in PDF format. Order a reprint of this article now + Need a Real Sponsor here + AUGUST 11, 2008 Some Stores Quiet Over Card Breach Customers Not Told About Alleged Theft of Consumer Data By JOSEPH PEREIRA , JENNIFER LEVITZ and JEREMY SINGER-VINE + Article + Comments more in Business » Boston Most states mandate that companies tell their customers when their credit-card data is stolen from the stores. The laws are designed to give consumers a chance to protect themselves against fraud or identity theft. But when federal prosecutors disclosed last week that computer hackers swiped more than 40 million credit-card numbers from nine retailers in the biggest such heist ever, it was the first time that many shoppers had heard about it. [photo] Associated Press Boston Market said it didn't tell customers their credit-card numbers were stolen because it never confirmed data were stolen from the restaurant chain. That's because only four of the chains clearly alerted their customers to breaches. Two others -- Boston Market Corp. and Forever 21 Inc. -- say they never told customers because they never confirmed data were stolen from them. The other retailers -- OfficeMax Inc., Barnes and Noble Inc., and Sports Authority Inc. -- wouldn't say whether they made consumer disclosures. Computer searches of their Securities and Exchange Commission filings, Web sites, press releases and news archives turned up no evidence of such disclosures. The other companies allegedly targeted by the ring charged last week were: TJX Cos., BJ's Wholesale Club Inc., shoe retailer DSW Inc., and restaurant chain Dave and Buster's Inc. They each disclosed to customers they were breached shortly after the intrusions were discovered. The disclosure issue emerged after the government charged 11 men in five countries, including the U.S., Ukraine and China, with orchestrating a high-tech operation to steal credit-card numbers from 2003 to 2008. After an increasing number of such thefts in recent years, more than 40 states have adopted laws requiring companies to give consumers an early warning when their personal information is stolen. Companies typically have made disclosures by letter, whenever possible, and through public announcements on the Web sites and in press releases to the media. Disclosure allows consumers to act quickly to limit losses -- by canceling their credit cards, changing their passwords or setting up credit-monitoring services. The Federal Trade Commission estimates nearly $50 billion is lost annually as a result of identity theft and credit-card fraud, with part of it absorbed by banks. "If I were the companies, I would be issuing public disclosures five nanoseconds after the indictments were announced," says Evan Stewart, an adjunct professor at Fordham University School of Law and an electronic-data breach expert. "If not, there could be big checks the companies will have to be writing" to cover consumer litigation, he said. Dan Clements, chief executive of Affinion Security Center's CardCops unit, which monitors Internet chat-rooms for illegal trafficking of credit and debit cards, says many companies are reluctant to disclose breaches. "Telling the public that they've been breached is embarrassing for them, it makes them suffer a loss of goodwill and in the case of public companies, the stock price goes down." OfficeMax has denied having any knowledge of a breach. New Jersey authorities who investigated the company in 2005 believed it was one of a number of retailers who was compromised, and last week's indictments describe how the defendants allegedly broke into their networks. Boston Market and Forever 21 say their own investigations couldn't corroborate the government's findings. Federal officials say they stand by the information in the indictments. The indictments allege that one of the suspects, Christopher Scott and another man identified only by initials broke into the wireless network of an OfficeMax store in Miami in 2004 and gained access to credit-card data. Mr. Scott, through family members, declined to comment. Authorities also said they discovered in 2005 that OfficeMax's computer systems had been breached by another group that obtained customer data and used it to make counterfeit credit cards. "We believe the [credit-card] information was coming out of an OfficeMax in North Carolina," said Lt. Tom Cooney, of the Hudson County Prosecutor's office in Jersey City, N.J. "It turned out that a number of the victims" were customers at the same OfficeMax. Edward DeFazio, a Hudson County prosecutor, says investigators in the joint federal-state probe notified OfficeMax and other retailers that their systems had been breached in a card-theft ring. Fourteen people were arrested in March 2006. That month, OfficeMax acknowledged in an SEC filing an "ongoing federal investigation involving legitimate debit-card use at various retailers that was later tied to fraudulent transactions outside the U.S." But the filing added that "we have no knowledge of a security breach at OfficeMax." In a statement following last week's indictments, the Naperville, Ill.-based company said, "it would be inappropriate to express our views relating to an ongoing criminal investigation." It said it has cooperated with authorities in their probe and was "confident in the integrity and security of our systems." Last week's indictments also describe "attacks on Forever 21," which operates more than 350 clothing stores. Prosecutors allege that sometime this year, Damon Patrick Toey, of Miami, broke into Forever 21's system and shared access with Albert Gonzalez, the group's alleged ringleader, "for the purpose of downloading credit-card information of customers of Forever 21." Lawyers for Mr. Gonzalez declined to comment. Mr. Toey couldn't be reached to comment. Larry Meyer, spokesman for Forever 21, says that this spring, federal authorities notified the Los Angeles-based retailer that it was among several retailers whose computer systems were "potentially infiltrated" by a crime ring. Authorities "asked us to investigate for a breach," he says. He says Forever 21 conducted an internal investigation but didn't find a sign of a breach. Therefore, he says, the company didn't notify customers that their credit-card information was potentially at risk. "There was no breach," he says. "There was nothing to tell people." He says Forever 21 believes it is only obligated to make a disclosure if it finds a breach. He added that as a result of last week's indictments, the company was in discussions with federal authorities. The indictments also allege that Boston Market, a fast-food chain based in Golden, Colo., was hit by credit-card thieves. Company spokeswoman Angela Proctor acknowledges that the company was notified by federal authorities in 2004 about a potential breach. She says it never disclosed the matter to consumers "because we couldn't find any definite information that we'd been breached." Ms. Proctor now says it isn't likely the company will inform consumers "because there is no way for us to identify customers who might have been affected." She added, "The consumer always does have an opportunity to report fraudulent activities" to credit-card companies. Barnes and Noble, the New York-based bookseller, issued a release last week saying it "had not received inquiries from credit card companies or customers about these alleged activities." A company spokeswoman declined to comment further. Sports Authority, based in Englewood, Colo., didn't return phone calls. TJX, the Framingham, Mass.-based owner of stores including T.J. Maxx, Marshalls, HomeGoods and A.J. Wright retail chains, says it has spent $202 million in expenses related to the breach, which compromised the cards of millions of its customers. Most of the money is being used to settle lawsuits brought by consumers and banks and to pay settlements with credit-card associations. Write to Joseph Pereira at joe.pereira@wsj.com and Jennifer Levitz at jennifer.levitz@wsj.com Copyright 2008 Dow Jones & Company, Inc. All Rights Reserved This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit www.djreprints.com More In Business + Email + Printer Friendly + Order Reprints + + Share: o Yahoo! Buzz Yahoo Buzz o MySpace MySpace o Digg Digg + + Back To + Back To + + MSN Money Homepage + MSN Money Investing Email Newsletters and Alerts The latest news and analysis delivered to your in-box. Check the boxes below to sign up. WSJ.com Email Features [_] This Week's Most Popular [_] On the Editorial Page More Information on WSJ Features [_] Also send me information about more WSJ Features The email address is already associated with another account. Please enter a different email address: Newsletter Signup Enter Your Email ____________________ Sign Up [BUTTON] SIGN UP Thank you ! You will receive in your inbox + Terms and Conditions + Go to Email Center null Email Newsletters and Alerts The latest news and analysis delivered to your in-box. Check the boxes below to sign up. WSJ.com Email Features [_] News Alert [_] In Today's Paper [_] Newshound Quiz Submit The email address null is already associated with another account. Please enter a different email address: Enter Your Email ____________________ Sign Up [BUTTON] SIGN UP + New! To sign up for Keyword or Symbol Alerts click here. + To view or change all of your email settings, visit the Email Setup Center. Thank you ! You will receive in your inbox. + Manage Email preferences Companies within this Article Dave & Buster's Inc.(DAB) 18.03 0.01 3/8 Barnes Noble Inc.(BKS) 26.70 0.69 2:08p.m. BJ's Wholesale Club Inc.(BJ) 40.21 1.90 2:08p.m. TJX Cos.(TJX) 34.19 0.95 2:08p.m. Sports Authority Inc.(TSA) 37.25 0.03 5/3 DSW Inc. Cl A(DSW) 13.67 -0.16 2:07p.m. Video + previous + + next + Mazda's Hydrogen Hybrid Unites Green Technology 5:00 + Japanese Car Runs on Water 5:00 + Honda CEO on Hydrogen-Car Plans 6:00 More in Business + Goldman's Net Drops 70% + Barclays Nears Lehman Deal + AIG Down Again Amid Cash Crisis + New York Fed Injects Liquidity + Inflation Eases on Oil Price Drops Most Popular + Read + Emailed + Video + Commented + Subscriber Content Read Preview 1. AIG Faces Cash Crisis as Stock Dives + 2. Lehman Files for Bankruptcy, Merrill Sold + 3. Why Feminists Hate Sarah Palin + 4. Paulson's Ultimatum Sparked Frantic End + Subscriber Content Read Preview 5. Dow Drops 500 Points + 1. Why Feminists Hate Sarah Palin + 2. Ten Ways to Protect Your Finances From the Crisis + 3. Thinking Outside the Lox + 4. New Evidence on Taxes and Income + Subscriber Content Read Preview 5. AIG Faces Cash Crisis as Stock Dives + 1. Japanese Car Runs on Water + 2. Sarah Palin Beat My Dad + 3. Honda CEO on Hydrogen-Car Plans + 4. Ken Rosen: Fed Cut May Be Big + 5. Individual Investors React to Market Shakeup + 1. How to Handle a Market Gone Mad8 comments + 2. AIG Faces Cash Crisis As Stock Dives 61%5 comments + 3. IRS Wants Free E-Filing5 comments + 4. BofA and CEO Are Poised to Ascend Banking Ladder4 comments + 5. Creamery Case Has Palin Critics Taking Aim at Fiscal-Conservative Claim4 comments + Most Read Articles Feed + Most Emailed Feed + Most Popular Video Feed + Most Commented Feed + Email + Printer Friendly + Share: o Yahoo Buzz more o MySpace o Digg + smaller Text Size larger + + Email + Printer Friendly + Order Reprints + + Share: o Yahoo! Buzz Yahoo Buzz o MySpace MySpace o Digg Digg + Email Newsletters and Alerts The latest news and analysis delivered to your in-box. Check the boxes below to sign up. WSJ.com Email Features [_] This Week's Most Popular [_] On the Editorial Page More Information on WSJ Features [_] Also send me information about more WSJ Features The email address is already associated with another account. Please enter a different email address: Newsletter Signup Enter Your Email ____________________ Sign Up [BUTTON] SIGN UP Thank you ! You will receive in your inbox + Terms and Conditions + Go to Email Center null Email Newsletters and Alerts The latest news and analysis delivered to your in-box. Check the boxes below to sign up. WSJ.com Email Features [_] News Alert [_] In Today's Paper [_] Newshound Quiz Submit The email address null is already associated with another account. Please enter a different email address: Enter Your Email ____________________ Sign Up [BUTTON] SIGN UP + New! To sign up for Keyword or Symbol Alerts click here. + To view or change all of your email settings, visit the Email Setup Center. Thank you ! You will receive in your inbox. + Manage Email preferences Ask a Question + Journal Community Let the Journal Community answer your questions. Please fill out all required fields. Please enter a question. The Question description should not be more than 2000 characters. Please choose a category Please choose a SubCategory The language you used does not comply with community standards. Please re-enter. [Choose a Category*.......] [Sub-category] [_] Notify me when I receive answers + Ask + *Required Video + previous + + next + Mazda's Hydrogen Hybrid Unites Green Technology 5:00 + Japanese Car Runs on Water 5:00 + Honda CEO on Hydrogen-Car Plans 6:00 Journal Community + close window Hello Your question to the Journal Community Your comments on articles will show your real name and not a username.Why? Why use your real name? The Journal Community encourages thoughtful dialogue and meaningful connections between real people. We require the use of your full name to authenticate your identity. The quality of conversations can deteriorate when real identities are not provided. Please enter your first and last name First name: ________________ Last name: ________________ [_] Create a Journal Community profile to avoid this message in the future. (As a member you agree to use your real name when participating in the Journal Community) + Post + Cancel + Privacy Policy + Community Rules Notice: Your participation access with Journal Community has been disabled due to violation of Journal Community Guidelines. If you feel you have reached this status change in error, please contact TBD@wsj.com + back to top Search News, Quotes, Companies Search News, Quotes, Companies ____________________ Search (Submit) Search + Log In or Subscribe to access your WSJ.com Account WSJ.com Account: o My Account o Billing Information Help & Information Center: o Help o Customer Service o Contact Us o New on WSJ.com o Tour the new Journal + About: o News Licensing o Advertising o Conferences o About Dow Jones o Privacy Policy - Updated o Subscriber Agreement & Terms of Use - Updated o Copyright Policy o Jobs at WSJ.com + WSJ.com: o Site Map o Home o U.S. o World o Business o Markets o Market Data o Tech o Personal Finance o Life & Style o Opinion o Autos o Careers o Real Estate o Small Business + Tools & Formats: o Today's Paper o Video Center o Graphics o Columns o Blogs o Alerts o Newsletters o Mobile o Podcasts o RSS Feeds o Journal Community o Message Center o Forums + The Wall Street Journal Digital Network o WSJ.com o Marketwatch.com o Barrons.com o AllThingsD.com o FiLife.com o BigCharts.com o Virtual Stock Exchange o WSJ Asia o WSJ Europe o Foreign language editions: o WSJ Chinese o WSJ Portuguese o WSJ Spanish Copyright ©2008 Dow Jones & Company, Inc. All Rights Reserved Enter your question*