TJX Reveals Scope of Security Thefts

TJX Cos. Inc. (Framingham, Mass.) says information from at least 45.7 million credit and debit cards was stolen by hackers who gained access to TJX’s customer information in a security breach that occurred in 2005, involving records going back to 2003.

The specialty discount retailer, which operates about 2500 stores, disclosed the scope of its losses in its fiscal 2007 annual report filed with the Securities and Exchange Commission. It had discovered the breach and reported it publicly in January. It said in the regulatory filing that about three-quarters of the cards had either expired at the time of the theft or that data from their magnetic strips had been “masked” (in other words, stored as asterisks rather than as numbers).

But TJX acknowledged that it still knew little about the breach, in part because the hacker or hackers gained access to the TJX encryption software and could have unscrambled the information.

In addition, TJX deleted much of the transaction data in the normal course of business between the time of the breach and the time that TJX detected it, making it impossible to know how many cards were actually affected.

“There is a lot of information we don’t know, and may never be able to know, which is why this investigation has been so laborious,” a TJX spokeswoman said.

TJX says its computer systems were first breached in July 2005 by hackers who gained access to information from customer transactions dating to January 2003. TJX says it did not discover the breach until about three months ago.

In addition to the information from 45.7 million transactions beginning in January 2003, another 455,000 customers who returned merchandise without receipts had their personal data stolen, including driver’s license numbers.

At the time it revealed the breach, in January, the company said the intruders had taken the credit and debit card records of “a limited number of people, substantially less than millions of people,” as well as a small number of driver’s license numbers.

Police charged six people in Florida last week with using credit card numbers that investigators say were stolen from a TJX database to buy about $1 million in merchandise with gift cards.