SSL Encryption and Identity Theft: Are Your Favorite Stores Your Worst Enemies?

See All Articles in Identity Theft Basics Print

Unless you're a network security administrator, a web programmer, or a computer geek, it's not likely that you've heard of SSL encryption. Maybe you have, since SSL encryption and its performance as a data-loss prevention measure have received a lot of media coverage in the last several years.

There have been some huge data breaches involving the credit card accounts and personal information of millions of people who were under the protection of SSL encryption. Sadly, merchants who didn't invest in upgrading their data-loss prevention software were easy targets for hackers. These hackers exploited the weaknesses of obsolete SSL encryption protocols and used the stolen data to commit identity theft on an unprecedented scale.

What is SSL encryption?

Secure Sockets Layer (SSL) is a cryptographic protocol for protecting information sent over networks such as the World Wide Web. SSL encrypts information at the Application Layer to ensure the safe transfer of data to the Transport Layer. Every time someone sends a packet of information — e.g., an e-mail, an instant message, a request to view a web page, or a credit card verification request — SSL encryption takes the information and encrypts it until it can be decoded at its final destination. This is a very simplified explanation of a fairly complicated process, but the purpose of SSL encryption is to prevent electronic eavesdropping while data packets travel from one place to another.

SSL encryption as an archaic data-loss prevention measure came into the public eye after the largest data breach of all time occurred. TJX Companies, Inc., owns many popular retail stores, including TJ Maxx, HomeSense, Marshall's, Bob's Stores, and others. Early in 2007, TJX acknowledged that hackers stole the debit and credit card accounts and other personal information of 45.6 million people from its computer networks over a period of 18 months. An investigation found that hackers first accessed this information in July 2005 and continued to exploit the weaknesses of an outdated SSL protocol called WEP encryption.

Updating to the more secure WPA encryption across a network as large as TJX's would have cost millions. Instead, TJX (and many, many others) delayed investing in more robust data-loss prevention until a later date. Ironically, TJX ended up spending millions anyway in fines, data-loss prevention upgrades, and damages in lawsuits filed by identity theft victims.

The TJX data breach is a cautionary tale for all consumers. No matter how careful consumers are about protecting credit card numbers and other personal information, all that caution can be for naught if they use their credit or debit cards at a merchant with outdated data-loss prevention protocols.

Member Login

Your Security - Guaranteed

The articles and information available are for educational and reference purposes only. They do not constitute, and should not be construed as, legal or financial advice. Any legal or financial principles discussed here are for general information purposes only and may differ substantially in individual situations and/or in different states or countries. For specific legal or financial advice, please consult a licensed attorney or a financial professional. IdentityHawk® does not control or guarantee the accuracy of any information provided through external links from the articles on this website to any other website, nor does the IdentityHawk® privacy policy apply to any personal information that may be collected via the external links.

*Identity theft insurance underwritten by subsidiaries or affiliates of Chartis Inc. The description herein is a summary and intended for informational purposes only and does not include all terms, conditions and exclusions of the policies described. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. View the summary of your benefits. If you cancel your membership in the first 30 days, the insurance coverage will be cancelled as of your original membership start date.

Coverage for residents of New York is limited to a $25,000 maximum. New York residents: view the summary of your benefits.

IdentityHawk® provides you with the tools you need to access and monitor your financial/credit information through the program's credit reporting and monitoring benefits. IdentityHawk® provides only limited credit monitoring services which are accessible to its members via the identityhawk.com website. IdentityHawk® is not accepting new customers. Credit information provided by TransUnion Interactive, Inc.