TK Maxx data theft may have hit 94 million cards

gallery

TJX, the clothing retailer operating in the UK as TK Maxx may have been victim to an even bigger data theft than originally believed, new court papers filed by affected banks have revealed.

The documents, which cite senior security officials at credit card platform operators MasterCard and Visa claim that as many as 94 million card accounts affecting customers in both the UK and the US that have shopped in a TK Maxx or TJ Maxx store may have been compromised by the data theft. TJX said it believes its computer systems were hacked in July 2005, then on subsequent dates in 2005 and from mid-May 2006 to mid-January 2007. The stolen data related mostly to sales and returns made between 2003 and 2004.

However, TJX has hit back stating that it stands by its original figure of 45.7 million card accounts being compromised by the theft.

Visa and MasterCard declined to comment further on the court filings.

Various UK and US banks are taking action against TJX in an attempt to reclaim the costs associated with replacing customer cards, changing card numbers and handling significant amounts of administration associated with card replacement requests and fraud investigations.

In the court filings, which were unsealed late last night in a US federal court in Boston, Joseph Majika, Visa's US vice president of investigations and fraud states that the company alerted card issuing banks that around 65 million Visa cards could be affected.

"I'm not sure if this is, in fact, the final number," stated Majika. "Visa has had fraud reports related to the theft from 13 countries, but mostly from within the US."

MasterCard security official Neil Maguire stated in a 27 September deposition that around 29 million MasterCard cards were affected by the theft.

TJX spokeswoman Sherry Lang said in an article published by USA Today that the company stands by its original figures, and that 75 per cent of the data stolen related to expired cards or contained obscured data - card numbers that were incomplete as a security countermeasure, making them useless.

Email to a friend

Print this page