Target removes CEO in wake of cyber attack | Hacker News Reader

Target removes CEO in wake of cyber attack

reuters.com

111 pointswiremine93 comments

Here's a link to USA Today. http://www.usatoday.com/story/money/business/2014/05/05/targ...

Why do people often link to wsj? I always thought that kinda strange.

Because that's where they read it?

Yes, but you'd think they'd have enough awareness that most people on HN don't have paid subscriptions to WSJ which defeats the whole point of posting something to share information.

On the other hand, the submitter gets to signal "I read the WSJ and pay for a subscription!" to HN.

That's not very useful for anyone else on HN is it? It's gotten to the point where I'm tempted to petition that sites with pay walls just get banned.

Thanks for the link!

In the months since [the hack was found], Target adopted a faster timeline for switching to more secure chip-based credit and debit cards, and the payment terminals that accept them. As part of the $100 million effort, Target announced last week that it all of its store-branded cards would be reissued as MasterCard chip-and-pin cards in 2015.

This will only help customers who have such cards, which is... visitors from Europe? Anyone else? A more valuable feature for the new terminals would be code signing for firmware updates.

Maybe it will drive credit card companies to start implementing chips. One can dream ...

Travelling to Europe without such cards is extremely painful.

Target has their own line of credit and debit cards which they push aggressively in-store, I assume these plans pertain to those.

Correct, it's written in the quoted passage

"all of its store-branded cards would be reissued as MasterCard chip-and-pin cards"

My recent citibank card replacement had a chip in it.

There was no advertising of this fact, but I noticed the chip, it's visible, as they generally are.

This led me to try googling to figure out what was going on... I'm still a bit confused. It looks like most major US banks are going to be issuing cards with chips in 2014-2015... but oddly, for the person familiar with these from Europe, I'm not sure there are any plans to actually start using PIN's. They are going to continue with signature-based authentication... but maybe the PoS devices are going to be doing something with the chip, even though not requiring a PIN? Got me, I'm still confused.

Pretty much everyone in Canada has the chip and pin system now.

I had a chip and pin card in 2007 and alot of merchants have had card readers capable of using them since mid 2005.

To be fair, I fail to see what sacking a CEO has to do with a technologically negligent practice. Yes, their Canadian expansion was botched but it seems like there might just be bad media reporting trying to link everything back to their very public fuckup? Wouldn't the CIO be more liable for such faults as a massive data breach? I do see the small comments in the article regarding CIO upheaval but unless there was some evidence of the CEO actively undermining security in the information sector of the company is this just another case of chief officers canning the guy to save face?

It seemed strange to me as well, especially in the face of their rapid rollout of chip-and-pin "Target" cards, announced only last week:

http://money.cnn.com/2014/04/30/technology/security/target-c...

or the CISO

What CISO?

http://www.ianetsec.com/blogs/ians-perspective/target-proves...

That's one of the curious roles of CEO. If things go wrong, you resign. Helps the company draw a line under the incident and show that they are "moving on", even when it's complete nonsense.

I don't think this fact is discussed much when people talk about excessive executive compensation. It's sort of like TV actors who negotiate tens of thousands of dollars per episode or sports stars who may not have more than a five year career.

A big part of the CEO's role is to manage investor confidence. Confidence in a company's vision, execution, and communication underwrites its equity value. Replacing a CEO who has lost the market's confidence is more than ceremonial.

Not, it's not ceremonial. But, I don't think anyone used that term, except you. The parent said it was nonsense, which is true.

Sure, it's part of the CEO's job to inspire confidence, but what's nonsense is that virtually any CEO would be responsible for any single tech-vulnerability down the line.

So, it may well be that investors expect that, which would mean that the nonsense is on their part. And, perhaps Target is simply responding to that nonsense, but it's still nonsense.

Said another way, it's not ceremonial if it matters. But, it is nonsense that it would matter.

I had assumed it was similar to the role of a plant manager: they are public responsible for the company. There are circumstances where, if a plant is found to be in breach of the law, the plant manager can be sent to jail as part of the punishment (I think often in relation to environmental regs and safety breaches - never seen it in person, though).

the CIO resigned in March

> Wouldn't the CIO be more liable for such faults as a massive data breach?

Two thoughts:

1. The outgoing CIO, Beth Jacobs, was also their Chief Content Officer. Given her background [1], and the fallout, I'd suggest she was hired for the content side of her job, not the traditional technology-centric CIO skill set. She was promoted in 2008, the same hear the now outgoing CEO came in. I didn't find a connection, but my guess is the CEO brought in the CIO. If so, he's responsible for the mis-hire.

2. Beyond that, I think we'll see more of this: CEOs wouldn't be able to pass the buck on poor technology decisions as easily as they might have 10 or 15 years ago.

[1] http://articles.latimes.com/2014/mar/05/business/la-fi-mo-ta...

Multinational corporations have adopted the CEO firing as a customary response to major scandal. It lets them publicly demonstrate that they're changing, while simply replacing the CEO with a near-equivalent.

There is a saying in the UK "Meet the new boss, Same as the old boss" (it's also a lyric in the Who song "Won't get fooled again").

http://dilbert.com/strips/comic/2009-12-02/

In this case?

Ever heard the phrase "the buck stops here"?

The CEO might not be to blame for the breach but he is responsible.

Personally, I think it's good that the CEO has lost his job over this. It's the sort of incident (along with the cost of Sony's breach[1]) that can be used as a cautionary tale pour encourager les autres to take security seriously.

1: http://www.zdnet.com/blog/btl/sonys-data-breach-costs-likely...

As is frequently done with headlines and business/financial news snippets, a one-liner reason is given, possibly completely irrelevant to the level of change.

'Kcots Stock closed 10% lower today on increasing speculation that Kcots Stock may have been intentionally named like a pallendrome.'

I didn't read the article as I got paywalled.

However I noticed that 'Target CEO Resigns Over Data Breach' was the headline introduced by the OP, and not the one in the WSJ.

They also lost a ton of money in their expansion into Canada, so it's not just the data breach.

It's funny ... their big push into the Canadian market brought a few stores to my area ... almost everything in the store is priced higher than the alternative stores here. I don't see much advantage to them, and have bought nothing from them.

On the flip side of that coin, one of the Zellers locations that closed down due to Target coming in has reopened again. Target never moved into their lease, so they are still Zellers ...

I thought Target bought Zellers.

Target only bought the leases, it seems. Hudson Bay Co. still owns the "Zellers" discount brand name, etc.

A number of Zellers stores stayed open the whole time, even though the idea was to wind them all down by March of 2012, I think.

The whole movement into Canada seems like it was a terrible let-down for Target ...

I don't see much competition on price, but I wasn't a huge fan of Zellers. Most of my (few) trips to Walmart have felt like "Dante's Inferno meets Lord of the Flies", so I'm quite happy to have Target in Canada now.

To be honest, I get pretty much everything I need from any of the bigger Grocery stores, which all carry more than just basic groceries now.

Most anything else, I get from Home Hardware or Canadian Tire. I confess, though, I get most of the kids' clothes from Walmart. I do occasionally get some from Zellers or Real Canadian Superstore.

True. You can get a lot of the stuff that Target sells elsewhere. One thing that I like about Target in my neighbourhood is that it's generally so empty that it feels like you have the whole place to yourself. (Not that that's sustainable in the long term.) It's also open until 10 PM, which generally makes it the only store open after 9 PM around here.

As a Canadian who has relocated permanently to the U.S., I really wish there was an equivalent to Canadian Tire in the U.S.

Wouldn't that be Sears? Most Sears stores I've seen have an auto section along with clothes, tools, appliances, home goods, etc.

Even in the United States, Target is priced higher than Wal-Mart. People still go to Target. It's viewed as a somewhat higher class store than Wal-Mart.

Strange - I don't quite see that - maybe it's regional?

There are some things Walmart in our area is lower on, but it's usually less than a 2% difference on the things we buy. We've got the Target Red Card, so everything's 5% off, which usually means it's < Walmart. Walmart is slightly further from us as well, so Target is faster to get to.

But more than that, to me, the checkout experience at Walmart is usually abysmally slow (self-checkout makes is sometimes OK). Target by me rarely has more than 2 people ahead of you - in busy times I see a floor manager calling more people up to open cash registers - that's quite common here. Walmart - never. Yeah, it keeps their prices a bit lower, maybe, but I'd usually rather pay the extra 70 cents and be out 7 minutes faster.

If I'm in the mood for more savings, Aldi has them both beat, and I go to Aldi a couple times a month to stock up on stuff. IMO, Walmart gets beat on price by Aldi, and on service by Target.

...the checkout experience at Walmart is usually abysmally slow (self-checkout makes is sometimes OK).

Checkout was why, when I last lived in densely-populated areas, I would put off the WalMart run until I absolutely had to go, for those things Target or other stores didn't carry. (Out here in the hinterland WalMart seems adequate.) It has been a few years, but in my experience self-checkout did not speed up the process. It seemed as if most of my fellow shoppers might have had better luck if they'd been asked to operate the Space Shuttle.

self-checkout is hit and miss. I really really really wish for 2 things:

1. "beginner" flag on some self-checkout systems

2. An actual roped walkway up to the self-checkout area, like in a bank. You get to the front, you choose the next available area. I've lost track of how many times someone was 'behind' me, but walked past me to grab a kiosk I was walking towards. insane.

There's so many ways self-checkouts can be improved, I don't believe for a moment the arguments against it when I read "people prefer live tellers". There are a few live tellers I prefer, but I don't prefer live tellers overall over self-checkout, but self-checkout is implemented so poorly at so many stores... argh...

> Strange - I don't quite see that - maybe it's regional?

Counter-intuitively, I have found that the quality of a Walmart is proportional to how rural the surrounding area is. Walmart's in metro areas, next to expensive suburbs (say, any of the towns surrounding DC)? Total 3rd world shit. Walmarts in busted down ex-mining towns deep in PA? Surprisingly nice. Empty, but nice.

Maybe it's just because an empty walmart is a walmart that doesn't take much abuse. They all sell more or less the same shit, except the mining town walmart will also sell ammo.

There does seem to be a perception that Walmart is cheaper. Certainly that helps them in many regards.

However this study from late 2012 found that Walmart was not cheaper in a survey of 150 items across a region:

http://www.businessinsider.com/target-is-actually-cheaper-th...

Granted, this study was from late 2012 and I don't have personal anecdotal experience to compare as I don't live in the states anymore.

I'm in this camp. Target is also a little closer to my house and easier to get to, but the shopping environment is much nicer even though much of the inventory is identical. After I shop at Wal-Mart I feel like I need a shower. Not so much at Target. K-Mart is similar, but while Wal-Mart just has an air of bone-cutting industrial cheapness, K-Mart is more sad, it's more like the dilapidated shanty, leaning to one side, with ten kids playing in the yard.

> K-Mart is more sad, it's more like the dilapidated shanty, leaning to one side, with ten kids playing in the yard.

I'll bet I first stepped foot in to a K-Mart some 40 years ago. The really sad thing is that by my recollection, K-Mart has always been that way. Dirty, poorly-lit in many cases, and eternally in need of an update. Perhaps there was a time that K-Mart stores looked shiny, new and not run down, but it must have been before my time.

There was a time in the Super K era where the stores were pretty well done. The grocery store side was even pretty nice. It did pretty well in some areas, but they just couldn't change their reputation and Target kept the high end and Walmart kept the low end, leaving Kmart in this bad middle ground.

It's bad enough how dirty and run down K-Mart stores are but another thing that always drives me crazy is you can't easily find stuff at different K-Mart stores as it seems each store's floor plan is laid out differently (and all their floor plans seem haphazardly).

Target is designed for women - clean, nice colors, lighting, friendliness.

Source - My dad is a retired sales rep in that market.

I'm not a woman, but to me the fact that it's clean and bright makes it much less soul-crushing to shop retail.

In Australia, it's colloquially pronounced/called "Tar-jey, women's fashions"

Do men not like these things? Does Target actually get significantly more than 50% women shopping?

Target is generally higher than Wal-Mart because a lot of the merchandise tends to be higher quality. With some items, though, price varies, and Target can be cheaper if there's a sale involved.

Target: you'll pay a few bucks more, but you don't have to go to Wal-Mart!

Wal-Mart is ghetto, but you are very likely to get the lowest possible price ... for junk.

Target is a moderate discount store that has nicer displays, wider aisles, and some higher end products. It's Wal-Mart for the middle class.

In Canada, Walmart seems to be at the level of USA Target in terms of store quality. When I moved to the USA, I didn't understand why people said 'ugh walmart' until I went to a USA Walmart. So to a typical Canadian, target just seems like a smaller walmart.

The lines tend to be much shorter at the Target here, that's the prime reason I avoid the nearer Walmart. I'm not sure if it costs more or less in practice, they seem about the same to me really. Walmart does have a better selection of motor oil though and they take my old oil for recycling, so that's about the only reason I go to Walmart anymore, but it's annoying to wait in that long line with just 5qt of Castrol.

I live in a city with a Target. I think. No one has ever mentioned it. I have no idea if it's actually opened yet. Never seen an ad, billboard. Still in stealth mode I guess!

I hyped my (Canadian) parents on Target, so I was disappointed to hear that when they went to one when it opened in their city, I was disappointed when they reported that the selection and quality of merchandise was poor. It wasn't anything like a normal U.S. Target store, is what they told me.

I have only been to one Canadian target and none in the US, here it seemed exactly like Zellers, which they replaced. Why are the american ones so great?

Did they lose money or is it attributable to a capital expenditure cycle?

I went to a WalMart store in one of the suburbs of Montreal around 2003 and you couldn't walk in it it was so full. So color me surprised that this didn't work out.

Granted, that's ten years ago...

We changed the url from http://online.wsj.com/news/articles/SB1000142405270230341710...

How about a simple ban on paywalled sites?

Those with ready workarounds (NY Times / cookies) aren't so bad. WSJ loses on both its editorial bias and paywall. Financial Times, though often quality reporting, isn't worth the bother of links either.

I agree that we should prefer non-paywalled links where possible, but I don't want to risk missing the important, solid articles that do occasionally come up at those sites.

The link appears to be behind a pay-wall.

As always with WSJ, take 3 seconds and type the title into Google to bypass the pay-wall.

I'd really rather not be raising their page read metrics.

Because all information should be totally free? Newspapers, Television Shows, Movies, Music, Software, Books, Comics, Magazines, etc... Nobody should ever charge money for content, and they must be punished if they attempt to do so?

No, but there are equally good free alternatives. I wanted to read about this so I came to the comments, found a link to the USA Today article, and read that instead.

I'm not the one advocating "stealing" by defeating the paywall here! I'm suggesting NOT trying to gain unauthorized access. As is usually the case, there are plenty of alternate sources for this information, which derives largely from a press release.

> I'm suggesting NOT trying to gain unauthorized access

In what way is accessing WSJ via Google's search results unauthorized?

What does WSJ's AUP/TOS say?

Don't know. Are they behind a paywall?

No. They put them in front of the paywall so people can read and agree to them before subscribing.

They call them "subscriber terms of use", but the TOS claims to cover people who are not subscribed.

I mention TOS and AUP because it seems some US courts will see this as what makes access authorised or not.

It's annoying, it disrupts the discussion on HN (there are several top-level threads discussing the paywall and accessibility of the content, dang has edited the URL to a freely available link).

I'm aware that the news industry has its revenue challenges (and just wrote a fairly lengthy comment on some of those issues: https://news.ycombinator.com/item?id=7692730). But at the same time, if a particular news organization makes the determination that it's not going to provide its content generally, then general discussion sites are just as free to decide that they're not going to link back and refer to the site.

I'd argue that the vast decline in the already shaky standard of WSJ's reportage since being acquired by the Murdoch Disinformation Empire doesn't do much to favor it either.

I don't think that information should be linked to from HN if there are alternatives. I completely agree w/ you on the idea of paying for superior quality content (I have no opinion on if WSF qualifies for that label though).

Alternatives:

http://www.reuters.com/article/2014/05/05/us-target-ceo-idUS...

http://www.forbes.com/sites/clareoconnor/2014/05/05/target-c...

Both tested (unscientifically) as pay wall free.

I'm not being lazy, just respectful of the pay wall. WSJ made a commercial decision to add a pay wall, but because of the way Google search works, they must expose content to Google to have discoverability by search, hence the 'cache' backdoor.

I'd rather people linked to content that was not behind pay walls. The USA Today article linked in another post contains additional reporting.

I had a boss who insisted that companies would fail over data breaches like TJ Maxx's. I doubted him, and still do, but this news gives him a couple more percentage points of likelihood.

Well there is still a long list of breaches that didn't demand a sacrifice [1]. Sony, Adobe, Steam, etc.

[1] http://www.informationisbeautiful.net/visualizations/worlds-...

It would completely depend on the severity and cost of the breach. This one was huge and cost Target millions (maybe a billion, Im not sure honestly). For sure the head of IT and CEO would be purged in a situation like this one.

It's odd to me that they have to take the blame for a disaster that was caused by the terrible security of how credit cards fundamentally work.

It is impossible to secure credit cards. They are the keys to your money in plain text. PCI is hell to comply with because of this, and doesn't even solve the problem because you still have to store them in plain text.

Target would be 100% right to blame the credit card industry for the disaster, but it wouldn't go over well with the public because the public does not understand security.

Prepare to go through this discussion again in two years after chip-and-pin's expensive rollout doesn't prevent or deter online CC theft, despite everyone having to get fancy new cards from their banks.

That took a long time. I guess the last of his options were up about 12 hours ago.

I was working on credit/debit card auth. 20+ years ago, and we wondered then why it didn't go all smart card. That division was housed with the smart card group, and Europe was going smart card. Debit card security was pretty good at the time, but this was all a long time ago.

> and we wondered then why it didn't go all smart card.

Because nobody wants to pay for it; its cheaper to push the cost onto the merchant.

Isn't the US going to smart cards within a couple years?

Target has a coupon app called Cartwheel. You get a certain number of coupon slots that you can fill with pretty good deals. When you go to Target you scan your phone at checkout and it knows what coupons you have selected and reduces the price of the products you purchased. The more you spend with Cartwheel coupons the more slots you get to fill up. My wife thinks this is great. She saves us a lot of money and its kinda fun for her to find and pick savings based on what she wants. Target is making a fucking killing on this. We shop there frequently (it's cleaner than the local Wal-Mart too) and Target is mining our data and influencing our purchases with their app. I can't help like being a product when I'm getting decent savings and deals I want even if store I'm working with is making it work for them too.

How much did Target actually lose as a result of the breach, and how much of this talk is just post hoc ergo propter hoc?

Probably unmeasurable. I was a victim of credit card fraud because of the Target breach, and though ultimately I didn't lose a dime, I didn't step into Target (the closest major retailer to my apartment) during the entire Christmas season. Also, since then, if I have the urge to buy something at Target, and I'm not carrying enough cash to pay for it, I choose another store. That can't be good.

Paywall. TC;DR

Time to write three letters.

Reply on news.ycombinator.com