11 ms·

Target removes CEO in wake of cyber attack

111 points by wiremine 12y ago

j-b 12y ago
The link appears to be behind a pay-wall.
- ghshephard 12y ago
  As always with WSJ, take 3 seconds and type the title into Google to bypass the pay-wall.
  - daphneokeefe 12y ago
    I'd really rather not be raising their page read metrics.
    - ghshephard 12y ago
      Because all information should be totally free? Newspapers, Television Shows, Movies, Music, Software, Books, Comics, Magazines, etc... Nobody should ever charge money for content, and they must be punished if they attempt to do so?
      - benburton 12y ago
        No, but there are equally good free alternatives. I wanted to read about this so I came to the comments, found a link to the USA Today article, and read that instead.
      - daphneokeefe 12y ago
        I'm not the one advocating "stealing" by defeating the paywall here! I'm suggesting NOT trying to gain unauthorized access. As is usually the case, there are plenty of alternate sources for this information, which derives largely from a press release.
        snsr 12y ago
        > I'm suggesting NOT trying to gain unauthorized access In what way is accessing WSJ via Google's search results unauthorized?
        DanBC 12y ago
        What does WSJ's AUP/TOS say?
        middus 12y ago
        Don't know. Are they behind a paywall?
        DanBC 12y ago
        No. They put them in front of the paywall so people can read and agree to them before subscribing. They call them "subscriber terms of use", but the TOS claims to cover people who are not subscribed. I mention TOS and AUP because it seems some US courts will see this as what makes access authorised or not.
        dredmorbius 12y ago
        It's annoying, it disrupts the discussion on HN (there are several top-level threads discussing the paywall and accessibility of the content, dang has edited the URL to a freely available link). I'm aware that the news industry has its revenue challenges (and just wrote a fairly lengthy comment on some of those issues: https://news.ycombinator.com/item?id=7692730 https://news.ycombinator.com/item?id=7692730). But at the same time, if a particular news organization makes the determination that it's not going to provide its content generally, then general discussion sites are just as free to decide that they're not going to link back and refer to the site. I'd argue that the vast decline in the already shaky standard of WSJ's reportage since being acquired by the Murdoch Disinformation Empire doesn't do much to favor it either.
      - bdavisx 12y ago
        I don't think that information should be linked to from HN if there are alternatives. I completely agree w/ you on the idea of paying for superior quality content (I have no opinion on if WSF qualifies for that label though).
  - josefresco 12y ago
    Alternatives: http://www.reuters.com/article/2014/05/05/us-target-ceo-idUSBREA440BD20140505 http://www.reuters.com/article/2014/05/05/us-target-ceo-idUS... http://www.forbes.com/sites/clareoconnor/2014/05/05/target-ceo-gregg-steinhafel-resigns-in-wake-of-data-breach-fallout/ http://www.forbes.com/sites/clareoconnor/2014/05/05/target-c... Both tested (unscientifically) as pay wall free.
  - keithpeter 12y ago
    I'm not being lazy, just respectful of the pay wall. WSJ made a commercial decision to add a pay wall, but because of the way Google search works, they must expose content to Google to have discoverability by search, hence the 'cache' backdoor. I'd rather people linked to content that was not behind pay walls. The USA Today article linked in another post contains additional reporting.
daphneokeefe 12y ago
Here's a link to USA Today. http://www.usatoday.com/story/money/business/2014/05/05/target-ceo-steps-down/8713847/ http://www.usatoday.com/story/money/business/2014/05/05/targ...
- kevando 12y ago
  Why do people often link to wsj? I always thought that kinda strange.
  - endersshadow 12y ago
    Because that's where they read it?
    - chaostheory 12y ago
      Yes, but you'd think they'd have enough awareness that most people on HN don't have paid subscriptions to WSJ which defeats the whole point of posting something to share information.
      - saraid216 12y ago
        On the other hand, the submitter gets to signal "I read the WSJ and pay for a subscription!" to HN.
        chaostheory 12y ago
        That's not very useful for anyone else on HN is it? It's gotten to the point where I'm tempted to petition that sites with pay walls just get banned.
- jessaustin 12y ago
  Thanks for the link! In the months since [the hack was found], Target adopted a faster timeline for switching to more secure chip-based credit and debit cards, and the payment terminals that accept them. As part of the $100 million effort, Target announced last week that it all of its store-branded cards would be reissued as MasterCard chip-and-pin cards in 2015. This will only help customers who have such cards, which is... visitors from Europe? Anyone else? A more valuable feature for the new terminals would be code signing for firmware updates.
LandoCalrissian 12y ago
They also lost a ton of money in their expansion into Canada, so it's not just the data breach.
- Marcus316 12y ago
  It's funny ... their big push into the Canadian market brought a few stores to my area ... almost everything in the store is priced higher than the alternative stores here. I don't see much advantage to them, and have bought nothing from them. On the flip side of that coin, one of the Zellers locations that closed down due to Target coming in has reopened again. Target never moved into their lease, so they are still Zellers ...
  - jonny_eh 12y ago
    I thought Target bought Zellers.
    - Marcus316 12y ago
      Target only bought the leases, it seems. Hudson Bay Co. still owns the "Zellers" discount brand name, etc. A number of Zellers stores stayed open the whole time, even though the idea was to wind them all down by March of 2012, I think. The whole movement into Canada seems like it was a terrible let-down for Target ...
  - oalders 12y ago
    I don't see much competition on price, but I wasn't a huge fan of Zellers. Most of my (few) trips to Walmart have felt like "Dante's Inferno meets Lord of the Flies", so I'm quite happy to have Target in Canada now.
    - Marcus316 12y ago
      To be honest, I get pretty much everything I need from any of the bigger Grocery stores, which all carry more than just basic groceries now. Most anything else, I get from Home Hardware or Canadian Tire. I confess, though, I get most of the kids' clothes from Walmart. I do occasionally get some from Zellers or Real Canadian Superstore.
crazytony 12y ago
That took a long time. I guess the last of his options were up about 12 hours ago.
danielweber 12y ago
I had a boss who insisted that companies would fail over data breaches like TJ Maxx's. I doubted him, and still do, but this news gives him a couple more percentage points of likelihood.
- jonlucc 12y ago
  Well there is still a long list of breaches that didn't demand a sacrifice [1]. Sony, Adobe, Steam, etc. [1] http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ http://www.informationisbeautiful.net/visualizations/worlds-...
- ProAm 12y ago
  It would completely depend on the severity and cost of the breach. This one was huge and cost Target millions (maybe a billion, Im not sure honestly). For sure the head of IT and CEO would be purged in a situation like this one.
imjustsaying 12y ago
As is frequently done with headlines and business/financial news snippets, a one-liner reason is given, possibly completely irrelevant to the level of change. 'Kcots Stock closed 10% lower today on increasing speculation that Kcots Stock may have been intentionally named like a pallendrome.' I didn't read the article as I got paywalled. However I noticed that 'Target CEO Resigns Over Data Breach' was the headline introduced by the OP, and not the one in the WSJ.
atoponce 12y ago
Paywall. TC;DR
dang 12y ago
We changed the url from http://online.wsj.com/news/articles/SB10001424052702303417104579543461881354816 http://online.wsj.com/news/articles/SB1000142405270230341710...
- dredmorbius 12y ago
  How about a simple ban on paywalled sites? Those with ready workarounds (NY Times / cookies) aren't so bad. WSJ loses on both its editorial bias and paywall. Financial Times, though often quality reporting, isn't worth the bother of links either.
  - dang 12y ago
    I agree that we should prefer non-paywalled links where possible, but I don't want to risk missing the important, solid articles that do occasionally come up at those sites.
TheCapn 12y ago
To be fair, I fail to see what sacking a CEO has to do with a technologically negligent practice. Yes, their Canadian expansion was botched but it seems like there might just be bad media reporting trying to link everything back to their very public fuckup? Wouldn't the CIO be more liable for such faults as a massive data breach? I do see the small comments in the article regarding CIO upheaval but unless there was some evidence of the CEO actively undermining security in the information sector of the company is this just another case of chief officers canning the guy to save face?
- bdamm 12y ago
  It seemed strange to me as well, especially in the face of their rapid rollout of chip-and-pin "Target" cards, announced only last week: http://money.cnn.com/2014/04/30/technology/security/target-credit-card/ http://money.cnn.com/2014/04/30/technology/security/target-c...
- lanstein 12y ago
  or the CISO
  - darkarmani 12y ago
    What CISO? http://www.ianetsec.com/blogs/ians-perspective/target-proves-cisos-are-no-longer-nice-to-haves.aspx http://www.ianetsec.com/blogs/ians-perspective/target-proves...
- untog 12y ago
  That's one of the curious roles of CEO. If things go wrong, you resign. Helps the company draw a line under the incident and show that they are "moving on", even when it's complete nonsense.
  - michaelfeathers 12y ago
    I don't think this fact is discussed much when people talk about excessive executive compensation. It's sort of like TV actors who negotiate tens of thousands of dollars per episode or sports stars who may not have more than a five year career.
KevinEldon 12y ago
Target has a coupon app called Cartwheel. You get a certain number of coupon slots that you can fill with pretty good deals. When you go to Target you scan your phone at checkout and it knows what coupons you have selected and reduces the price of the products you purchased. The more you spend with Cartwheel coupons the more slots you get to fill up. My wife thinks this is great. She saves us a lot of money and its kinda fun for her to find and pick savings based on what she wants. Target is making a fucking killing on this. We shop there frequently (it's cleaner than the local Wal-Mart too) and Target is mining our data and influencing our purchases with their app. I can't help like being a product when I'm getting decent savings and deals I want even if store I'm working with is making it work for them too.
ArkyBeagle 12y ago
I was working on credit/debit card auth. 20+ years ago, and we wondered then why it didn't go all smart card. That division was housed with the smart card group, and Europe was going smart card. Debit card security was pretty good at the time, but this was all a long time ago.
- toomuchtodo 12y ago
  > and we wondered then why it didn't go all smart card. Because nobody wants to pay for it; its cheaper to push the cost onto the merchant.
- TwoBit 12y ago
  Isn't the US going to smart cards within a couple years?
GFK_of_xmaspast 12y ago
How much did Target actually lose as a result of the breach, and how much of this talk is just post hoc ergo propter hoc?
- pessimizer 12y ago
  Probably unmeasurable. I was a victim of credit card fraud because of the Target breach, and though ultimately I didn't lose a dime, I didn't step into Target (the closest major retailer to my apartment) during the entire Christmas season. Also, since then, if I have the urge to buy something at Target, and I'm not carrying enough cash to pay for it, I choose another store. That can't be good.
fsckin 12y ago
Time to write three letters.
fragsworth 12y ago
It's odd to me that they have to take the blame for a disaster that was caused by the terrible security of how credit cards fundamentally work. It is impossible to secure credit cards. They are the keys to your money in plain text. PCI is hell to comply with because of this, and doesn't even solve the problem because you still have to store them in plain text. Target would be 100% right to blame the credit card industry for the disaster, but it wouldn't go over well with the public because the public does not understand security.
- bryne 12y ago
  Prepare to go through this discussion again in two years after chip-and-pin's expensive rollout doesn't prevent or deter online CC theft, despite everyone having to get fancy new cards from their banks.

111 points by wiremine 12y ago

j-b 12y ago

The link appears to be behind a pay-wall.

ghshephard 12y ago
As always with WSJ, take 3 seconds and type the title into Google to bypass the pay-wall.
- daphneokeefe 12y ago
  I'd really rather not be raising their page read metrics.
  - ghshephard 12y ago
    Because all information should be totally free? Newspapers, Television Shows, Movies, Music, Software, Books, Comics, Magazines, etc... Nobody should ever charge money for content, and they must be punished if they attempt to do so?
    - benburton 12y ago
      No, but there are equally good free alternatives. I wanted to read about this so I came to the comments, found a link to the USA Today article, and read that instead.
    - daphneokeefe 12y ago
      I'm not the one advocating "stealing" by defeating the paywall here! I'm suggesting NOT trying to gain unauthorized access. As is usually the case, there are plenty of alternate sources for this information, which derives largely from a press release.
      - snsr 12y ago
        > I'm suggesting NOT trying to gain unauthorized access In what way is accessing WSJ via Google's search results unauthorized?
        DanBC 12y ago
        What does WSJ's AUP/TOS say?
        middus 12y ago
        Don't know. Are they behind a paywall?
        DanBC 12y ago
        No. They put them in front of the paywall so people can read and agree to them before subscribing. They call them "subscriber terms of use", but the TOS claims to cover people who are not subscribed. I mention TOS and AUP because it seems some US courts will see this as what makes access authorised or not.
        dredmorbius 12y ago
        It's annoying, it disrupts the discussion on HN (there are several top-level threads discussing the paywall and accessibility of the content, dang has edited the URL to a freely available link). I'm aware that the news industry has its revenue challenges (and just wrote a fairly lengthy comment on some of those issues: https://news.ycombinator.com/item?id=7692730 https://news.ycombinator.com/item?id=7692730). But at the same time, if a particular news organization makes the determination that it's not going to provide its content generally, then general discussion sites are just as free to decide that they're not going to link back and refer to the site. I'd argue that the vast decline in the already shaky standard of WSJ's reportage since being acquired by the Murdoch Disinformation Empire doesn't do much to favor it either.
    - bdavisx 12y ago
      I don't think that information should be linked to from HN if there are alternatives. I completely agree w/ you on the idea of paying for superior quality content (I have no opinion on if WSF qualifies for that label though).
- josefresco 12y ago
  Alternatives: http://www.reuters.com/article/2014/05/05/us-target-ceo-idUSBREA440BD20140505 http://www.reuters.com/article/2014/05/05/us-target-ceo-idUS... http://www.forbes.com/sites/clareoconnor/2014/05/05/target-ceo-gregg-steinhafel-resigns-in-wake-of-data-breach-fallout/ http://www.forbes.com/sites/clareoconnor/2014/05/05/target-c... Both tested (unscientifically) as pay wall free.
- keithpeter 12y ago
  I'm not being lazy, just respectful of the pay wall. WSJ made a commercial decision to add a pay wall, but because of the way Google search works, they must expose content to Google to have discoverability by search, hence the 'cache' backdoor. I'd rather people linked to content that was not behind pay walls. The USA Today article linked in another post contains additional reporting.

daphneokeefe 12y ago

Here's a link to USA Today. http://www.usatoday.com/story/money/business/2014/05/05/target-ceo-steps-down/8713847/ http://www.usatoday.com/story/money/business/2014/05/05/targ...

kevando 12y ago
Why do people often link to wsj? I always thought that kinda strange.
- endersshadow 12y ago
  Because that's where they read it?
  - chaostheory 12y ago
    Yes, but you'd think they'd have enough awareness that most people on HN don't have paid subscriptions to WSJ which defeats the whole point of posting something to share information.
    - saraid216 12y ago
      On the other hand, the submitter gets to signal "I read the WSJ and pay for a subscription!" to HN.
      - chaostheory 12y ago
        That's not very useful for anyone else on HN is it? It's gotten to the point where I'm tempted to petition that sites with pay walls just get banned.
jessaustin 12y ago
Thanks for the link! In the months since [the hack was found], Target adopted a faster timeline for switching to more secure chip-based credit and debit cards, and the payment terminals that accept them. As part of the $100 million effort, Target announced last week that it all of its store-branded cards would be reissued as MasterCard chip-and-pin cards in 2015. This will only help customers who have such cards, which is... visitors from Europe? Anyone else? A more valuable feature for the new terminals would be code signing for firmware updates.

LandoCalrissian 12y ago

They also lost a ton of money in their expansion into Canada, so it's not just the data breach.

Marcus316 12y ago
It's funny ... their big push into the Canadian market brought a few stores to my area ... almost everything in the store is priced higher than the alternative stores here. I don't see much advantage to them, and have bought nothing from them. On the flip side of that coin, one of the Zellers locations that closed down due to Target coming in has reopened again. Target never moved into their lease, so they are still Zellers ...
- jonny_eh 12y ago
  I thought Target bought Zellers.
  - Marcus316 12y ago
    Target only bought the leases, it seems. Hudson Bay Co. still owns the "Zellers" discount brand name, etc. A number of Zellers stores stayed open the whole time, even though the idea was to wind them all down by March of 2012, I think. The whole movement into Canada seems like it was a terrible let-down for Target ...
- oalders 12y ago
  I don't see much competition on price, but I wasn't a huge fan of Zellers. Most of my (few) trips to Walmart have felt like "Dante's Inferno meets Lord of the Flies", so I'm quite happy to have Target in Canada now.
  - Marcus316 12y ago
    To be honest, I get pretty much everything I need from any of the bigger Grocery stores, which all carry more than just basic groceries now. Most anything else, I get from Home Hardware or Canadian Tire. I confess, though, I get most of the kids' clothes from Walmart. I do occasionally get some from Zellers or Real Canadian Superstore.

crazytony 12y ago

That took a long time. I guess the last of his options were up about 12 hours ago.

danielweber 12y ago

I had a boss who insisted that companies would fail over data breaches like TJ Maxx's. I doubted him, and still do, but this news gives him a couple more percentage points of likelihood.

jonlucc 12y ago
Well there is still a long list of breaches that didn't demand a sacrifice [1]. Sony, Adobe, Steam, etc. [1] http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ http://www.informationisbeautiful.net/visualizations/worlds-...
ProAm 12y ago
It would completely depend on the severity and cost of the breach. This one was huge and cost Target millions (maybe a billion, Im not sure honestly). For sure the head of IT and CEO would be purged in a situation like this one.

imjustsaying 12y ago

As is frequently done with headlines and business/financial news snippets, a one-liner reason is given, possibly completely irrelevant to the level of change. 'Kcots Stock closed 10% lower today on increasing speculation that Kcots Stock may have been intentionally named like a pallendrome.' I didn't read the article as I got paywalled. However I noticed that 'Target CEO Resigns Over Data Breach' was the headline introduced by the OP, and not the one in the WSJ.

atoponce 12y ago

Paywall. TC;DR

dang 12y ago

We changed the url from http://online.wsj.com/news/articles/SB10001424052702303417104579543461881354816 http://online.wsj.com/news/articles/SB1000142405270230341710...

dredmorbius 12y ago
How about a simple ban on paywalled sites? Those with ready workarounds (NY Times / cookies) aren't so bad. WSJ loses on both its editorial bias and paywall. Financial Times, though often quality reporting, isn't worth the bother of links either.
- dang 12y ago
  I agree that we should prefer non-paywalled links where possible, but I don't want to risk missing the important, solid articles that do occasionally come up at those sites.

TheCapn 12y ago

To be fair, I fail to see what sacking a CEO has to do with a technologically negligent practice. Yes, their Canadian expansion was botched but it seems like there might just be bad media reporting trying to link everything back to their very public fuckup? Wouldn't the CIO be more liable for such faults as a massive data breach? I do see the small comments in the article regarding CIO upheaval but unless there was some evidence of the CEO actively undermining security in the information sector of the company is this just another case of chief officers canning the guy to save face?

bdamm 12y ago
It seemed strange to me as well, especially in the face of their rapid rollout of chip-and-pin "Target" cards, announced only last week: http://money.cnn.com/2014/04/30/technology/security/target-credit-card/ http://money.cnn.com/2014/04/30/technology/security/target-c...
lanstein 12y ago
or the CISO
- darkarmani 12y ago
  What CISO? http://www.ianetsec.com/blogs/ians-perspective/target-proves-cisos-are-no-longer-nice-to-haves.aspx http://www.ianetsec.com/blogs/ians-perspective/target-proves...
untog 12y ago
That's one of the curious roles of CEO. If things go wrong, you resign. Helps the company draw a line under the incident and show that they are "moving on", even when it's complete nonsense.
- michaelfeathers 12y ago
  I don't think this fact is discussed much when people talk about excessive executive compensation. It's sort of like TV actors who negotiate tens of thousands of dollars per episode or sports stars who may not have more than a five year career.

KevinEldon 12y ago

Target has a coupon app called Cartwheel. You get a certain number of coupon slots that you can fill with pretty good deals. When you go to Target you scan your phone at checkout and it knows what coupons you have selected and reduces the price of the products you purchased. The more you spend with Cartwheel coupons the more slots you get to fill up. My wife thinks this is great. She saves us a lot of money and its kinda fun for her to find and pick savings based on what she wants. Target is making a fucking killing on this. We shop there frequently (it's cleaner than the local Wal-Mart too) and Target is mining our data and influencing our purchases with their app. I can't help like being a product when I'm getting decent savings and deals I want even if store I'm working with is making it work for them too.

ArkyBeagle 12y ago

I was working on credit/debit card auth. 20+ years ago, and we wondered then why it didn't go all smart card. That division was housed with the smart card group, and Europe was going smart card. Debit card security was pretty good at the time, but this was all a long time ago.

toomuchtodo 12y ago
> and we wondered then why it didn't go all smart card. Because nobody wants to pay for it; its cheaper to push the cost onto the merchant.
TwoBit 12y ago
Isn't the US going to smart cards within a couple years?

GFK_of_xmaspast 12y ago

How much did Target actually lose as a result of the breach, and how much of this talk is just post hoc ergo propter hoc?

pessimizer 12y ago
Probably unmeasurable. I was a victim of credit card fraud because of the Target breach, and though ultimately I didn't lose a dime, I didn't step into Target (the closest major retailer to my apartment) during the entire Christmas season. Also, since then, if I have the urge to buy something at Target, and I'm not carrying enough cash to pay for it, I choose another store. That can't be good.

fsckin 12y ago

Time to write three letters.

fragsworth 12y ago

It's odd to me that they have to take the blame for a disaster that was caused by the terrible security of how credit cards fundamentally work. It is impossible to secure credit cards. They are the keys to your money in plain text. PCI is hell to comply with because of this, and doesn't even solve the problem because you still have to store them in plain text. Target would be 100% right to blame the credit card industry for the disaster, but it wouldn't go over well with the public because the public does not understand security.

bryne 12y ago
Prepare to go through this discussion again in two years after chip-and-pin's expensive rollout doesn't prevent or deter online CC theft, despite everyone having to get fancy new cards from their banks.