Hannaford Bros. Co., a grocery chain based in Scarborough, Maine, and owned by Belgium's Delhaize Group, announced on Monday 17 March 2008 that card numbers had been stolen from its computer systems. About 4.2 million unique credit and debit card numbers had potentially been exposed: at its 165 stores in New England and New York, at 106 stores of Sweetbay, an affiliated chain in Florida, and at some independent grocers that sold Hannaford products. About 1,800 cases of fraud had already been reported. The data "was illegally accessed from our computer systems during transmission of card authorization," Ronald Hodge, the chief executive, wrote in a statement; it was limited to card numbers and expiration dates, he said, and no names or addresses had gone.
Hackers were in the payment system as early as 7 December 2007, by the account the appeals court later set out from the customers' complaint. Visa told Hannaford on 27 February 2008 that its system had been breached; on 8 March the company discovered the means of access; on 10 March it contained the breach and told some of the banks. On 17 March the Massachusetts Bankers Association said that Visa and MasterCard had warned up to seventy banks in the state of a breach at a major retailer they had not named; not long afterwards Hannaford told the public. Fraudulent charges had by then been made as far afield as Spain and France. "We moved with all deliberate speed to get out to customers with information that we could have confidence in," said Carol Eleazer, Hannaford's vice-president of marketing.
How it was done came out in a letter from Hannaford's top lawyer to Martha Coakley, the Massachusetts attorney general, and the state's consumer affairs office, which the Boston Globe reported on 28 March. Software had been secretly installed on servers at each of the roughly 300 stores run by Hannaford and its partners; it intercepted card data as customers paid at the checkout and sent it overseas. Law enforcement officials, the letter said, called the method "new and sophisticated"; the company was still investigating how the software had reached so many servers; the Secret Service had its own inquiry. Nothing in Hannaford's account involved stored records. The numbers were caught "as the data was being transmitted from the card-swipe PIN pad across its private network to its centralized payment switch", Supermarket News reported that summer.
Hannaford had passed its assessment against the card industry's Data Security Standard in February 2008, as a year before; the breach cost it the certificate. The standard asked for card data to be encrypted "across open, public networks", not on a chain's private one, where Hannaford had encrypted it for only "part of the trip", Eleazer said; by August it was "encrypted from the [PIN pad] in the lane". Twenty-six lawsuits were combined in federal court in Maine. Judge D. Brock Hornby dismissed most claims in May 2009, the First Circuit revived those for card-replacement fees and identity-theft insurance on 20 October 2011, and Hornby refused to certify a class on 20 March 2013. In August 2009 a Newark grand jury charged Albert Gonzalez and two unnamed hackers over this breach and four others.
Last Laptop Standing
Pwn2Own, held at CanSecWest in Vancouver from 26 to 28 March 2008 with prizes from TippingPoint's Zero Day Initiative, offered three fully patched laptops: a MacBook Air running Leopard, a Fujitsu U810 running Vista with Service Pack 1, and a Sony Vaio running Ubuntu. On the first day, open only to remote attacks on the operating system, nothing fell. On the second, with browsers in scope for $10,000, Charlie Miller of Independent Security Evaluators, helped by colleagues Jake Honoroff and Mark Daniel, had a link opened in Safari and took the Air in under two minutes with an exploit prepared in advance; he had chosen the Mac, he said, because he thought it the easiest target. On the third, with popular third-party software allowed, Shane Macaulay, who had spent much of the previous day on the Vista machine, attacked it through an unknown flaw in Adobe Flash; Service Pack 1's new protections held until Alexander Sotirov supplied tricks, using Java, to get round them, and the Fujitsu was his. Ubuntu was never broken. Adobe patched Flash in early April; Apple fixed Miller's bug, a heap overflow in WebKit's handling of JavaScript regular expressions, on 16 April.
Imprudent Curiosity
On Thursday 20 March 2008 the State Department confirmed that Barack Obama's passport file had been opened without authorisation three times, on 9 January, 21 February and 14 March, by three contract employees. Two, employed by Stanley Inc., which had just won a passport services contract worth $570 million, were fired; the third, who had also looked at John McCain's file, was disciplined and kept on. A trainee had opened Hillary Clinton's in the summer of 2007. Software flagged lookups of high-profile records, yet senior officials learned of these only when a Washington Times reporter asked. "It's our initial view that this was imprudent curiosity," said Sean McCormack, the department's spokesman, and Condoleezza Rice telephoned the candidates to apologise. In July the inspector general reported that the files of 127 of 150 politicians, entertainers and athletes sampled had been opened 4,148 times since September 2002, in a system with about 20,500 users. On 22 September Lawrence Yontz, a contract intelligence analyst, pleaded guilty to viewing some 200 applications out of what he admitted was idle curiosity; by January 2009 two more people had pleaded guilty.
Five Hundred Rupees a Call
On 17 March 2008, the day Hannaford went public, the Telecom Regulatory Authority of India put money behind its rules on unsolicited commercial calls and messages for the first time. Nine months earlier it had said it had no power to impose penalties; now, its explanatory memorandum said, it had revisited the matter. A phone company that broke the rules could be made to pay a "financial disincentive" of up to ₹5,000, and up to ₹20,000 for each repeat, and a tariff order charged registered telemarketers ₹500 for a first unsolicited call or message and ₹1,000 for each after it. The notice that had to open a telemarketing message, which stakeholders complained ran to 160 characters, became "Pls speak to your operator if U do not want commercial msgs".
The National Do Not Call Registry, kept by the National Informatics Centre, had been running since October 2007. By March more than 8.3 million phone users had listed their numbers and about 13,600 telemarketers had registered; of some 1,522 million numbers they had submitted for checking, 1,411 million were cleared for calling. The design assumed a caller who registered. TRAI reworked it in later years, putting the checks on a distributed ledger under regulations of 19 July 2018, and on 13 August 2024 ordered operators to stop promotional voice calls from unregistered senders using SIP, PRI or other lines, after more than 7.9 lakh complaints against such senders in six months. Within three weeks 2.75 lakh numbers had been cut off and 50 entities blacklisted. The calls our India desk warns about now sell nothing at all.
BigDog keeps its footing
On 17 March 2008 a short film of BigDog reached the technology sites, and what it showed was ordinary work done without falling: climbing over rubble, walking through snow, getting its legs back under it after slipping on ice. Boston Dynamics had been building the four-legged robot since 2005 with Harvard's Concord Field Station on money from DARPA, which wanted a pack animal for ground that wheels could not cross; it weighed about 110 kilograms, carried up to 150 and balanced on some fifty sensors. Eleven days later Google's research blog described deploying GOOG-411, the free voice directory service opened the previous April, conceding that speech recognition was "not a solved problem" and reporting that its own callers' recordings trained the models nearly as well as web query logs. Its petrol engine proved too loud for combat and the army version was shelved, but Boston Dynamics passed to Google, SoftBank and Hyundai and was selling legged robots by 2020; the phone line closed in November 2010, its recordings having taught a method the trade still uses.
Microsoft buys a rootkit hunter
On 20 March 2008 Microsoft said it had bought Komoku, a Maryland company founded in 2004 whose hardware and software hunted rootkits — code that takes a machine over and hides from the scanners above it. Its customers were the ones who worry first: Homeland Security, the Defense Department and DARPA, which had helped pay for the work. Microsoft did not disclose the price, kept neither name nor product line, and sent most of the staff to its Access and Security Division; the detection was bound for Forefront and Windows Live OneCare, and what became of the consumer half of that plan belongs to November 2008. Eight days later a Delaware jury handed Finjan $9.18 million against Secure Computing, whose Webwasher and CyberGuard products shipped with a locked module for scanning unknown threats that three Finjan patents covered; the judge added half again, and an injunction followed in August 2009. Finjan sold its products business the next year and licensed the patents for a decade, until Fortress Investment Group bought it in 2020; Microsoft's own engine now ships switched on.
⏳ Time capsule — March 2008
- On 9 March, at 04:03 UTC, an Ariane 5 launched Jules Verne, the European Space Agency's first Automated Transfer Vehicle, from Kourou in French Guiana with 2,297 kilograms of water, oxygen, propellant and dry cargo for the International Space Station, and two original manuscripts by the novelist it was named for. It docked on 3 April and burned up over the South Pacific on 29 September.
- On 16 March, two days after the Federal Reserve Bank of New York had agreed an emergency loan, Bear Stearns agreed to be bought by JPMorgan Chase in a share swap worth $2 a share, with the New York Fed to take on $30 billion of its assets; on 24 March the price was raised to $10 a share.
- On 26 March Tata Motors agreed to buy Jaguar and Land Rover from Ford for about $2.3 billion in cash, with Ford putting up to about $600 million into their pension plans; the purchase closed on 2 June. The cyberattack that stopped JLR's factories belongs to September 2025.
- On 28 March, the third day of the first Test against South Africa at Chepauk in Chennai, Virender Sehwag reached 300 in 278 balls, the fastest triple century in Test cricket. Makhaya Ntini dismissed him for 319 the next day, and the match was drawn.
Encrypted From the Lane
Hannaford's repair became the industry's direction. On 15 September 2011 the PCI Security Standards Council published its first requirements for point-to-point encryption, in which card data is encrypted in a secure device where the card is read and decrypted only in a hardware security module. The thieves worked the gaps. At Target, as November 2013 records, a memory scraper read track data out of the register in the instant before encryption; Home Depot finished encrypting payments in its American stores only after its own breach was public, in September 2014; the liability shift of 1 October 2015 began retiring the stripe. IHG said its hotels already on point-to-point encryption were untouched by the malware of April 2017, and the trade moved on to the web, where June 2018 finds it.
The month's other stories have their sequels. Charlie Miller won Pwn2Own again in March 2009 by the same route, and in March 2010 took Safari for the third year running. The passport files left a pattern more than a scandal: software flagged the lookups and nobody senior knew until a reporter asked, the shape of the alert at Target that reached Bangalore and Minneapolis in November 2013 and went no further. TRAI's rules of 17 March have been reworked for nearly two decades and now chase callers who never registered. And Radboud University's break of the MIFARE Classic cipher, made that same month, is told with the court case it provoked in July 2008.