Complain about a product or service

TJX Data Breach Victims Reach 94 Million

Numbers just keep climbing as court filings reveal extent of the theft

By Martin H. Bosworth
ConsumerAffairs.com

October 26, 2007

The new number was nearly double the initial estimate of 46 million affected customers that TJX reported in early 2007, when the breach was first revealed.

Visa officials estimated losses of $65 million to $83 million as a result of the breach, the largest and most exact number provided yet. The new information may officially mark the TJX affair as the biggest data breach in history.

The information came as part of a lawsuit filed by a coalition of banks against TJX, whom the banks hold responsible for not securing and protecting cardholders' data as they performed transactions and made purchases.

“If we’re successful against TJX, the nation’s major retailers will finally wake up to the fact that not protecting consumer data is an unfair trade practice and that investment in data management systems to protect consumers and shield consumers against fraud and identity theft is required,” said Daniel Forte, president of The Massachusetts Bankers' Association.

The bank lawsuit is separate from a consumer class action lawsuit also filed against TJX in Massachusetts. TJX recently offered a settlement that would provide consumers with cash vouchers and special shopping days in exchange for absolving TJX and its partner, Fifth Third Bancorp, of any liability in the breach.

Although no arrests have been made in the TJX breach, investigations confirmed that hackers used wireless equipment to invade TJX's unprotected database of payment information while driving by or parking near stores owned by the TJX company, including TJ Maxx and Marshall's.

Once the thieves had the information, the customer data found its way into the "underground economy" that specializes in selling and sharing stolen personal data.

Credit card information from the TJX breach found its way into an $8 million fraud scam in Florida earlier this year. A ring of fraudsters used the stolen TJX data to create fake credit cards, which they used to purchase gift cards from Wal-Mart.

The thieves then "loaded up" the gift cards to the maximum amount, and used the cards to purchase expensive equipment such as plasma TVs and computers. The fraud ring was broken up by local and federal authorities, and the ringleader was sentenced to five years in prison and hundreds of thousands of dollars in fines.

In the latest court filing, Joseph Majka, Visa USA's vice-president of fraud management and investigations, said that totals from the TJX breach would continue to increase as the stolen information found its way into more thieves' hands.

"These are going to be sold off for a period of time in the future, so it's going to continue for some time out there," said Majka.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |