The Loss Prevention Furniture Alliance Holds
Value-Packed Meeting in Columbus, Ohio

Mission Statement: “A network of dynamic loss prevention professionals, building business partnerships while serving their respective home furnishings retail and ecommerce verticals in improving profitability and reducing loss related to fraud, theft and operational practices.”

Many informative topics were covered during this day-and-a-half meeting, including e-commerce fraud, active shooter incidents, and background screening changes. A special thank you to the vendors for their support; Tony Casper – Safe Passage (Active Shooter), Doug Grissom & Terry Bangasser – Innovis, and Bernie Pack – Accurate Information Systems.

The LPFA is planning their next meeting for June 2020 in Pittsburgh, PA adjacent to the NRF Protect Conference June 22-24th.

Any furniture retailers or vendors interested in this group please contact one of the group co-facilitators; Patrick Burns at Bob’s Discount Furniture patrick.burns@mybobs.com or Mike Case at Art Van Furniture mcase@artvan.com

Read the event recap from LPFA's last meeting in Chicago back in May here.

Pictured, seated left to right: Kelly Murphy-Iverson - American Freight Furniture & Mattress, Mark Zibel - Bob's Discount Furniture, Jay Tubaugh - American Freight Furniture & Mattress.

Standing, left to right: Patrick Burns – Bob’s Discount Furniture, Karen Klassen – Bob’s Discount Furniture, Armando Martinez - Bob's Discount Furniture, Laura Donohoe - Art Van Furniture, Tim Martin - American Signature & Value City, Dominic Zuccala – Big Lot’s, Joe Hlavac - Bob's Discount Furniture, Mike Case - Art Van Furniture, Matt Kellogg - American Freight Furniture & Mattress
 

Broad facial recognition adoption shows growing comfort in market
New companies, pilots, and services leveraging biometric facial recognition for a wide variety of use cases in the retail, healthcare, banking and payments, public transport, and other industries have been announced or reported, as the technology's use continues to expand. While controversy continues to spring up around some projects, the range of announcements seem to have mostly escaped negative publicity. biometricupdate.com

Police consider facial recognition in Denmark, Sweden, Romania, but bias concerns persist

ASIS: Allocation of Security Resources
The Global Security Industry's Focus Broadens Well Beyond Traditional Roles
The scope of security’s responsibility within organizations continues to broaden, and increasingly it includes such areas as risk management, business continuity, and cybersecurity.

That’s one finding of joint research from Security Management and Resolver, research which was the subject of a webinar earlier this month moderated by ASIS IT Security Council Chair Jess Sieben, CPP, CISSP. Sieben, who also is corporate security product manager at Resolver, was joined by his colleagues Ryan Thiessen and Anaud Ganpaul on Using Data to Allocate Your Security Resources, which is available for free on-demand by registering.

Here’s a look at the breakdown of security responsibilities:

Looking at security budgets, the study showed that while the typical budget for cybersecurity is seeing larger increases, both cyber and physical security budgets are on the rise:

Ganpaul cites this a positive development: “This is good news as one of the concerns we’ve been hearing is that the budget for the cybersecurity team can starve that physical security budget. But the data shows that they are continuing to fund both at the levels that they require.”

Where does budget go? asisonline.org

Whistleblower at Juul - Former Top Claims Exec
"Juul Knowingly Sold Tainted Nicotine Pods, Former Executive Says"
Refused to Recall 1 Million Tainted Pods
"Our Customers Are Drunk & Vaping"
In a lawsuit, a former senior vice president claims that he was fired for raising safety concerns and that the company’s C.E.O. said customers are “drunk and vaping” and wouldn’t notice the quality of the pods.

A former top executive of Juul is alleging that the e-cigarette giant sold at least one million contaminated mint-flavored nicotine pods — and refused to recall them when told about the problem in March.

In a lawsuit filed in the United States District Court for the Northern District of California on Tuesday, Siddharth Breja, who was senior vice president for global finance, claims he was fired on March 21 in retaliation for whistle-blowing and objecting to the shipment of the contaminated and expired pods and other illegal and unsafe conduct that “has jeopardized and continues to jeopardize public health and safety and the lives of millions of consumers, many of them children and teens.”

Mr. Breja detailed a culture of indifference to safety and quality-control issues among top executives at the company and quoted the then-chief executive Kevin Burns saying at a meeting in February: “Half our customers are drunk and vaping” and wouldn’t “notice the quality of our pods.”

Mr. Burns, who left the company in September, issued a statement Wednesday afternoon strongly disputing the quote. “I never said this, or anything remotely close to this, period,” the statement said. “As CEO, I had the company make huge investments in product quality, and the facts will show this claim is absolutely false and pure fiction.”

“He was terminated in March 2019 because he failed to demonstrate the leadership qualities needed in his role,” Mr. Kwong said. “The allegations concerning safety issues with Juul products are equally meritless, and we already investigated the underlying manufacturing issue and determined the product met all applicable specifications.”

In March, Mr. Breja said he learned that batches of pods flavored with mint-flavored liquid and nicotine had been contaminated and that 250,000 “Mint Refill Kits,” the equivalent of one million pods, had been shipped and were being sold by retailers.

Mr. Breja said he urged Juul’s chief financial officer to issue either a recall or put out product safety warnings. A week later, the complaint says, Mr. Breja was fired. nytimes.com

Editor's Note: Remembering the news of their CEO's departure shortly after the first reports of the vaping death in Chicago. If the board knew and was reacting to the information, this would be considered criminal conspiracy. Certainly the former CEO has liability here, both corporate and possibly personal.

Administration Keeping the Pressure on Huawei - ZTE
FCC Chair's Proposal Targets Chinese Technology Firms - Huawei & ZTE
Bans Buying & Funds Rip & Replace
Federal Communications Commission Chairman Ajit Pai is pushing a proposal that would ban U.S. telecommunications firms from using commission funds to buy equipment from companies deemed national security threats. The new rule would first target Chinese telecom companies Huawei and ZTE.

Pai unveiled two new draft rules on Monday, and the five-member commission is expected to vote on the proposals at a Nov. 19 meeting. The proposals come as telecom companies gear up to launch 5G networks.

One rule would ban companies from using funds from the FCC's Universal Service Fund to buy equipment from any company that is deemed a national security threat.

The second proposed rule would incentivize telecom companies to rip and replace Huawei and ZTE gear from their networks. The FCC would provide money and support to have telecommunications firms assess how much of their equipment comes from these two companies and then replace their gear with more "trusted suppliers," according to the proposal. govinfosecurity.com

How Fort Bragg Improved Its Asset Tracking With RFID
RFID Journal hosted a webinar provided by Ken Horton, Vizinex RFID's co-founder and CEO, and Al Williams, the president of SmarTrack. An archived recording of the presentation, titled "How Fort Bragg Improved Its Asset Tracking with RFID," is now available for viewing on demand, along with the presenter's slides.

Fort Bragg is the largest military installation in the world. The specialized RFID solution it used to track critical assets was causing problems with faulty adhesion, interrupted reads and blocked frequencies. Therefore, Vizinex RFID and Williams Software Associates teamed up to engineer an RFID solution that altered the Fort Bragg team's approach to asset management

During this webinar, Horton and Williams outlined the story of the deployment and the benefits of using RFID. The speakers explained how to track assets made of metal, including weapons; the difference between working with U.S. and overseas RFID suppliers; and how to engineer an RFID solution for environments unfavorable to RFID. rfidjournal.com

TMA Reopens Alarm Confirmation, Verification and Notification Standard for Comment
The Monitoring Association (TMA) will reopen a review of the TMA CS-V-O1 standard, Alarm Confirmation, Verification and Notification Procedures. This standard defines methods by which false notifications for signals received from security systems can be greatly reduced. It has been proven that confirming and verifying an alarm signal by a supervising station will drastically reduce false notifications. Alarm confirmation rises to its next level by defining multiple attempt confirmation, biometric, audio and video confirmation.

This 2016 TMA standard has been adopted by the various states and local units of government.

Recently reviewed and updated, the standard will re-open for public comment Nov. 1. Download a copy for review and comment here. sdmmag.com

NFC Technology Protects Brands Against Piracy
Fighting piracy and counterfeiting is at the heart of HID Global, which has developed technology that allows users to verify whether or not a product is authentic, via a single cell phone ringtone. Through a service called HID Trusted Tag, a product can be reliably authenticated along the supply chain, from production through distribution and to the point of sale.

At the time of purchase, a consumer can verify the authenticity of a product with a simple touch of his or her Android or iOS mobile device. This solution was created with the intention of protecting brands against black-market activities. Trusted Tag services combine HID's cloud authentication with its NFC tags, which are available in a variety of shapes and sizes for the purpose of authenticity verification. rfidjournal.com

LocatorX brings robust tracking technology to retail
Addressing Package Tampering & Theft
Product tampering has long been an issue in retail. Brands must maintain the integrity of their supply chain and ensure items are authentic and unmolested. There's a consumer-facing component, too: Package theft is an ongoing problem. Customers are looking to retailers for help securing their purchases, and what's needed is end-to-end product protection. That's where LocatorX comes on scene.

"When you think about putting labeling and tracking on a product, it comes into topics like anti-counterfeiting, theft prevention and tracking," Fletcher says. "Those are a key portion of retailing."

Fakes can be difficult to distinguish, and because they could get into consumers' hands in a number of ways, it's important to have good insight at every step.

"If you can put a tracking device on the item, you can track it through your supply chain," Fletcher says. "It also extends the relationship into the consumer lifecycle of the product."

"If you have a tracking device, you could continue to track something if it's stolen and get the ability to reduce the theft that's going on," Fletcher says. Among the capabilities LocatorX may release down the road are multiple linked tags. Where the container, shipping box and item share a tag, it would provide redundancy while also making it more challenging for someone to tamper with or steal the product.

LocatorX is rolling its technology out in three phases. The smart label, introduced last year, drives more vigorous oversight within the supply chain. A chip that supports multiple communication formats such as Bluetooth and near field communication was released earlier this year. Designed to provide more accurate tracking and status information, the chip automates the process of manual or optical scanning. stores.org

CEO of biggest US mall owner says retail industry is ‘reaching the bottom’ of bankruptcies
The CEO of the biggest mall owner in the U.S., Simon Property Group, says the retail industry looks to be “reaching the bottom” of a tumultuous wave of bankruptcies.

“We are having a high bankruptcy year. ... There’s no denying that,” David Simon told analysts Wednesday morning. “But I think we’re kind of reaching the bottom in ... 2019 on that stuff. It’s rivaling what happened in 2017. So, it’s not like something that we haven’t experienced before. But we know [what] we have to do.”

“As we put together our plans for next year, I think we’ll be OK,” Simon said. “We’re hustling. We’re finding new tenants.” cnbc.com

Watch Out Dollar Stores - Amazon's Coming
Dollar Stores Are Booming - Largest Year-over-Year Uptake in Retail
Dollar Stores Continue to Endure the Retail Apocalypse, for Now
Consumer interest in grocery shopping at dollar stores has gained significant traction in the past year. According to a report published in September 2019 by TABS Analytics and Caravan Engine, more than half of US internet users said they grocery shopped regularly at dollar stores, compared with just 33% who said the same in 2018. This is a significant shift in consumer grocery habits. Aside from the increased adoption of online grocery shopping (17% in 2018 and 37% in 2019), dollar store grocery saw the largest year-over-year uptake.

The top three US retailers with the most store openings in the first four months of 2019 were all dollar stores, according to Coresight Research. Collectively, Dollar General, Dollar Tree and Family Dollar opened more than 1,500 new locations.

More consumers are regularly shopping for groceries at dollar stores than any other time in the past five years. But dollar stores, which have been praised as survivors of the ongoing retail apocalypse, could face new pressure from Amazon come 2020.

Subsequent reporting from The Journal revealed Amazon's plan to open its new grocery stores in suburban areas outside of urban city centers, indicating that it will focus on targeting middle-income consumers.

USA Today cited Amazon's expansion of one-day shipping for Prime members on select low-price items as another potential threat to dollar stores.

It's too early to tell whether Amazon's efforts will be able to disrupt the dollar store industry. But if media speculation is correct about the positioning of Amazon's new grocery stores-and if one-day shipping continues to expand-dollar stores could face new challenges in the coming years. emarketer.com

Australia's Biggest Wage Case in History
Woolworths, Australia, underpaid thousands of workers by up to $300m
The supermarket giant Woolworths is to be investigated by the Fair Work Ombudsman in what is believed to be Australia's biggest wage underpayment case after admitting it owes staff as much as $300m.

Woolworths on Wednesday told the stock exchange it had so far identified 5,700 current staff it had underpaid for as much as nine years. There may be more.

The Fair Work Ombudsman, Sandra Parker, said she was "shocked" to see Woolworths join a list of large companies guilty of underpayment that already included Wesfarmers, Qantas, Commonwealth Bank, Super Retail Group and Michael Hill Jewellers. theguardian.com

Bankrupt Forever 21 to Close 200 Stores & Exit Most International Markets


Quarterly Results
Boot Barn Q2 comp's up 7.8%, net sales up 11.3%
Starbucks Q4 comp's up 5% globally, revenue up 7%, full yr comp's up 5% globally, revenue up 7%
Yum! Brands Q3 comp's up 3%, sales up 8%
Dine Brands Q3 IHOP's comp's u 1.2%, Applebee's comp's not provided, total revenue up 22%

* The vast majority of designer name brands with direct to consumer channels don't separate retail numbers out from their main numbers. Apple did until recently and stopped. Levi Strauss, Columbia Sportswear and most others just don't publicize the data or at least make it virtually impossible to find. Apple pulled back intentionally a few years ago and doesn't even publicize the number of retail stores they have. And from what we've read it's all about not giving the competition any information other than what they're legally obligated to publish.

'Enterprises are Losing the Email Security Battle'
Email Threats Poised to Haunt Security Pros into Next Decade
Decentralized threat intel sharing, more public-private collaboration, and greater use of automated incident response are what's needed to combat phishing.

As organizations begin to plan their cybersecurity strategy for 2020 and beyond, email security will certainly be high on leadership's agenda. That’s because phishing attacks continue to increase in sophistication and frequency, and email remains the number one vector for all cyber incidents. In fact, 90% of all cyberattacks begin with email, and the breadth of phishing detection, prevention, and response has become the ultimate SOC team burden.

As such, one thing is clear: Enterprises are losing the email security battle. This unpopular truth exists partially because of the complex email threat landscape. After all, it’s almost impossible for any organization to proactively defend against 130 million phishing attacks per quarter, not to mention the tens of thousands of permutations associated with each. Another contributing factor is the proliferation of payload-less, social engineering-driven phishing, such as business email compromise (BEC) and account take over (ATO), which enable attackers to bypass traditional server-level email security tools and trick human defenses with relative ease. darkreading.com

Ransomware Hackers Plead Guilty For Charging Uber To Delete Stolen Data
Two hackers pleaded guilty Wednesday (Oct. 30) in federal court on charges that they hacked both Uber and LinkedIn, and then extorted the companies in exchange for deleting the stolen information.

The defendants, Brandon Glover, of Florida, and Vasile Mereacre, of Toronto, Canada, have been released on bond, and are due to be sentenced in March. They have been accused of stealing 57 million Uber user records, including customer and driver data, from Amazon Web Services in November 2016. After three weeks of negotiating, the ride share giant paid the men $100,000 in bitcoin through a third party. Uber then discovered the identity of the hackers, eventually meeting up with both Glover and Mereacre and demanding they sign confidentiality agreements.

Then in December 2016, the men demanded money from LinkedIn’s Lynda.com to delete more than 90,000 stolen records. That communication was cut off one month later when the company started working to identify the hackers.

Glover and Mereacre were able to access the confidential corporate databases on AWS using stolen credentials.

“We’re dealing with the most sophisticated cyber actors in the world,” FBI Special Agent in Charge John F. Bennett said in a statement.

The men were each charged with one count of conspiracy to commit extortion involving computers, and are facing up to five years in prison and a $250,000 fine. pymnts.com

At Least 13 Managed Service Providers Pushed Ransomware this Year
Once hackers compromise an MSP's network, they can use its remote access tools to deploy ransomware to hundreds of companies and thousands of computers.

A new report published this week by threat intelligence firm Armor puts the number of managed service providers (MSPs) that got hit with ransomware this year at 13, possibly more.

Starting this year, ransomware gangs have realized that they could compromise the network of an MSP, and then use their remote access tools to deploy ransomware on the MSP's customer networks, infecting hundreds of companies and thousands of computers, all at once, with the push of a few buttons.

In a report published this week, Armor took a deeper look at the entire MSP ecosystem and unearthed several other incidents. In total, the company found 13, but many more could be unreported. zdnet.com

21 Million Logins for Top 500 Firms Found on the Dark Web
More than 21 million login credentials stolen from Fortune 500 companies have been found in various places on the dark web, many of them already cracked and available in plaintext form.

According to a news report, the information was compiled from multiple sources, such as markets in the Tor network, web forums, Pastebin, IRC channels, social networks and messenger chats. 21,040,296 is the exact number of credentials found, mostly from tech companies, the financial industry, healthcare, energy, telecommunications, retail, industrial, transport, aerospace and defense sectors.

Retail 682,003 logins

In an additional report, ImmuniWeb researchers say 16,055,871 of the credentials were compromised in the past 12 months. They note 95 percent of the credentials contain unencrypted, or brute-forced and cracked by the hackers, plaintext passwords. securitymagazine.com

Integrating security into IoT projects is not easy, but it’s increasingly urgent
With an installed base of 44 billion connected devices projected for 2023, the amount of data and information generated and shared will reach zettabytes of data, according to ABI Research.

“Much of that data will be sensitive, whether about an individual’s privacy or confidential business information. As such, it presents a lucrative opportunity for threat actors, as data has become a highly commoditized asset in modern societies.

“Add to that the potential of harnessing unprotected IoT devices for botnets, denial-of-service attacks, or even holding them hostage to ransomware, the imperative for security cannot be ignored,” emphasizes Michela Menting, Digital Security Research Director at ABI Research.

Several platforms and tools have emerged in the market recently, which can facilitate security implementation, even in the most basic IoT devices.

“Enterprises looking to deploy IoT can now more easily engage in securing them, in a more cost-effective manner that can enable faster time-to-market. End-to-end IoT security is within reach for enterprises large and small,” Menting concludes. helpnetsecurity.com

Thought-Controlled Drones - They're Coming
A U.S. government agency continues to move forward with researching and developing brain–computer interfaces that could allow individuals to control drones at the speed of thought.

The program, run by the U.S. Defense Advanced Research Projects Agency (DARPA), is called the Next-Generation Nonsurgical Neurotechnology (N3) program. DARPA launched the program in 2018 with the aim of developing a brain–computer interface (BCI) that doesn’t have to be surgically implanted. asisonline.org

Hacking Phones: How Law Enforcement Is Saving Privacy
It's no longer true that society must choose to either weaken everybody's privacy or let criminals run rampant. darkreading.com

83% of Boards Investing More in Cybersecurity - Source 2019 BDO Board Survey

Reflection and the
Next 20 Years

Celebrating their 20th anniversary, The Zellman Group continues to expand their offerings of LP and consulting services for retailers - from civil recovery, restitution and LP analytics, to the recent launch of their ORC Recovery solution. Stuart Levine, CEO; William Ramos, Director of ORC Recovery; and Jason Davies, former Director of ORC Investigations, reflect on the company’s history, what’s changed, what’s new, and what’s in store for Zellman Group’s future.
 

DuPage County, IL: Brothers may be linked to Home Depot $926,000 thefts in 19 other states
Authorities say twin brothers charged with stealing from a Downers Grove Home Depot store could be connected to similar thefts totaling almost $926,000 at the company's stores in 19 other states. John J. Miotke and Michael R. Miotke, 42, both of Round Lake, are each charged with theft. They appeared in DuPage County court this week. Michael Miotke turned himself in Tuesday, and John Miotke did Wednesday.

Both are free on bail. DuPage County Assistant State's Attorney Diane Michalak told Judge Jeffrey MacKay Wednesday that she anticipates the brothers could soon face a more serious charge of conducting a continuing financial crimes enterprise. She argued bail for both should be increased from the $75,000 set when arrest warrants were issued Oct. 2. But MacKay granted the Miotkes' requests to lower their bails. Their girlfriends posted the required $5,000. According to court records, on Aug. 16, 2018, John Miotke stole flooring, grills, power washers and lighting from the Downers Grove store, and on Nov. 15, 2018, Michael Miotke stole flooring, grills, power washers and lighting. Home Depot's organized-retail-crime investigators notified Downers Grove police, and they all worked together, Downers Grove police spokesman William Budds said. The theft charges were approved Oct. 2.

At John Miotke's bond hearing, Michalak said the duo used two methods: In one, they would buy items from a Home Depot store and leave. They would then re-enter the store, pick up identical items and "return" them using the receipt from the initial purchase.

At other times, Michalak said, they would go into a store, pick up items and walk out; if questioned, they would present a receipt from a previous purchase of the identical item. Michalak said it is believed they have been doing this since October 2014 in Alabama, Arizona, Florida, California, Indiana, Kansas, Kentucky, Missouri, Minnesota, Michigan, Nevada, New York, North Carolina, Oklahoma, Pennsylvania, South Carolina, Tennessee, Texas and Wisconsin.

She said records indicate that since March 2016, they are suspected of making fraudulent returns of 237 lawn mowers and 238 pressure washers, each valued at $599. Authorities also suspect them of fraudulent returns of 313 cases of vinyl flooring, and 164 snowblowers. She also argued bail should be increased because when the brothers were informed of the outstanding warrant in their cases, they went on "a road trip" to Texas and Colorado. dailyherald.com

Great Falls, MT: Sam’s Club associate stole $18K in merchandise to support meth habit
Police arrested a Great Falls man Tuesday after Sam’s Club reported an employee had stolen more than $18,000 worth of merchandise over the past month. According to charging documents, the Great Falls Police Department responded to Sam’s Club Tuesday for a complaint of theft involving an employee. The store’s management claimed Robert Joe Crawford, 49, had stolen 18 cell phones, one Chromebook and one tablet between Sept. 14 and Oct. 28. The items were valued at a total of $18,547. Crawford was arrested at Sam’s Club for the alleged thefts, where police reportedly found a small baggie of methamphetamine in his pocket. The affidavit states Crawford admitted to taking the items in order to support his drug habit. Crawford has a criminal record that includes crimes in California and Nevada, according to court documents. greatfallstribune.com

Marion, IL: Three men arrested in $2,000 Dillard’s Theft and Police Chase

Pierre, SD: Walmart electronic thief busted with $1,000 of merchandise