Mini-Case Analysis

Q4. All questions apply to case: Hannaford Brothers (HB)

A.  Based on your reading of the case below, do you feel there is any ethical issue in how the HB management handled the security breach? Explain briefly any three reasons.

B.  How can HB management improve its corporate ethics? Make three recommendations to management to improve corporate ethics.

C.  Suggest any three short-term priorities, and three long-term actions to HB management in order to defend against cyberattacks and mitigate various security risk factors.

Hannaford Brothers

Hannaford Brothers (HB) is a supermarket chain that employs 27,000 workers with 167 stores in 5 northeastern states and Florida. In December 2007, a security breach began at Hannaford involving customer credit and debit card data. It took three months before the breach was uncovered by customers themselves complaining to their banks about fraudulent transactions on their cards. The data breach was finally contained several months later while customers were not sure about the HB supermarket progress in fighting the breach and securing their financial records.

The data was captured illegally as the cards were swiped at the check-out line. To its credit, Hannaford Brothers met the payment card industry (PCI) standards for data protection, but the company did not use wireless technology to transmit unencrypted data. The PCI standards, however, do not require that card data be encrypted at the instant the card is swiped. At Hannaford, the unencrypted card data traveled over the store’s private network before reaching a server where it was encrypted and routed to the credit card company to complete the approval process.

While the investigation is continuing, one probable scenario is that an employee with administrative network access was involved. Malicious software was planted on servers in each of Hannaford’s stores; the software captured the unencrypted card data from customers and transferred it to an accomplice located overseas. Unfortunately, many businesses have spent considerable money to implement the current PCI data protection standards, which now appear to be inadequate.

Hannaford initial cooperation with customers and credit and debit card issuers to ensure that customers whose data was stolen are protected can be best described as slow and lacking the involvement of senior-level information security personnel. The firm notified law enforcement authorities and is working with them to track down those who are responsible.

Just a few days after Hannaford Brothers announced the data breach, multiple class action lawsuits were filed against the company alleging it was negligent for failing to maintain adequate computer data security for customer credit and debit card data. At the time the initial class action suit was filed, there had already been 1800 cases of reported credit and debit card fraud arising from the breach. Hannaford is likely facing years of litigation; tens of millions of dollars in legal fees, settlement costs, and customer credit monitoring services; and a reduction in sales revenue due to loss of customer trust.