Loading ...
If you do not read 27bstroke6 over on wired.com, you definitely should. Ryan is the main investigative reporter. He also has the distinction of having a famous hacker as his editor, Kevin Poulsen.
Thankfully this post is a bit more jocular. And, I can’t believe that I finally get to quote myself! What a relief! LOL! 
In a prior post, I wrote:
My biggest take-away from the TJX case was that the cost of the breach was about $5 million dollars or $0.01 loss a share. This is a far cry from the $1.7 Billion price tag reported by some media outlets.
The media outlet I linked to was a post on 27bstroke6.
In private correspondence Ryan Singel wrote me to say that:
I reported that one security firm pushed that estimate out. I also noted it was in their interest to have the number be high, and included their calculations in the post and asked my readers to judge their assumptions in the comments. Which they did.
Nobody knows what the cost will be to TJX given the number of suits, the probable fine from the FTC and the hard-to-quantify blow to the brand.
As Alex rightly pointed out, the $5 million dollars is the cost up to the point of the 10-K and that more costs could (will!) be incurred. (While I normally do not buy into reputational damage arguments, TJX has the potential to be an outlier in this respect too.)
My only point in mentioning the $5 million was to contrast some other estimates that, to me, seem exaggerated. I did not intentionally mean that Singel (as an author) was estimating the cost to truly be $1.7 Billion.
Singel also wrote that he enjoyed my recent debate with Shostack (here, here, and here):
And I admit to quite enjoying your and Adam’s debate. Which you may also quote me on.
And I just did!…
2 Comments
Your estimates are off by quite a bit. Financial losses from this breach will be much higher. For one add the recent 8 million in Florida related to this. Take a look at the fine ChoicePoint received a few years ago 10 million for 160,000 accounts which was nothing in comparison over 46 million accounts. Add to that the fees charged by financial institutes and credit card companies to process new cards and close accounts. I would really hate be that company that invest my pension plan in TJX…
The $5 million dollar was not an estimate. It was a quote from the TJX 10-K. Naturally, this number will increase, but I doubt if it will reach $1.7 billion.