I repeat: If you EVER shopped at TJ Maxx, Marshalls, Winners, or HomeSense, keep an eye on ALL your credit and debit card statements
TJX Data Breach Called "Biggest Ever"
46 Million Customers' Data Exposed to Identity Thieves
By Martin H. Bosworth
ConsumerAffairs.Com
March 29, 2007
Nearly 46 million TJX customers had their credit and debit card data exposed in an ongoing breach that lasted over 18 months, the company said today. The company the theft included personal data it had stored on 455,000 individuals, including drivers' license numbers and military identification numbers.
The new revelations led Gartner research analyst Avivah Litan to say that the TJX breach had "set a record" for the amount of personal information exposed, and was already being calling the "biggest ever."
The previous recordholder was CardSystems , the payment processor that had stored data on 40 million Visa and MasterCard users, and was hit by an outside hack in 2005. CardSystems, later sold to biometric payments processor PayByTouch, settled Federal Trade Commission (FTC) charges that it had failed to adequately protect the data.
TJX, the parent company of the TJ Maxx, Marshalls, Winners, and HomeSense shopping chains, reported that computer hackers had broken into its systems on Dec. 18, 2006, and had accessed customer card information from their payment processing systems. The company first hired specialists from IBM and General Dynamics to investigate the incident, then contacted local and federal law enforcement. The public was finally made aware of the breach on Jan. 13, 2007.
It was later determined that the first breach had occured in July 2005 , and that TJX's networks had suffered similar, albeit smaller, breaches in 2003 and 2004.
The hackers had gained access to the TJX network and were siphoning data even before it was encrypted for storage, and were apparently taking extra efforts to ensure their actions would not be detected by regular security sweeps. The hackers apparently had traps set up to pick up data during the card issuer's approval process, as well as access to the decryption key TJX used to read its data.