Complain about a product or service

TJX Data Breach Bigger than Earlier Estimates

February 22, 2007

TJX • TJX To Pay Mastercard $24 Million For Data Breach • TJX Settles with FTC Over Data Breach • TJX Settles with Banks over Data Breach • TJX Settles Visa Suit over Data Breach • Attorneys General Oppose TJX Data Breach Settlement • TJX Data Breach Victims Reach 94 Million • TJX Data Breach Settlement Has Strings Attached • Wireless Hackers Suspected In TJ Maxx Breach • TJX Data Breach Called "Biggest Ever" • Data From T.J. Maxx Breach Connected To Florida Fraud • TJX Data Breach Bigger than Earlier Estimates • Massachusetts, Rhode Island Open TJX Probes • TJX Sued for Loss of Consumer Data • Hackers Hit T.J.Maxx, Marshalls • Congress Takes On Data Security --- • TJX Customers: What To Do

The security breach involving customer data held by TJX Companies, Inc. now appears much worse than originally reported, beginning as much as 10 months earlier, according to the company's latest statement.

TJX now says that the breach, originally thought to have taken place in May 2006, actually first occurred in July 2005, and was the first of several breaches throughout 2005.

TJX confirmed that shoppers in the U.K. and Ireland were also affected, in addition to customers of TJX-owned stores such as Marshall's and T.J. Maxx in the U.S., and Winners and Home Sense in Canada.

TJX also reported evidence of hacks into credit and debit card transactions in the U.S. and Puerto Rico from January 2003 through June 2004, as well as credit card transactions in Canada during the same time period.

The company did not say whether the different breaches were linked or caused by separate groups. TJX has also not disclosed the total number of customers affected by any of the breaches, though other sources have claimed it may be as high as 40 million.

Carol Meyerowitz, TJX's president and CEO, said in a statement that the company was "working with leading computer security firms to investigate the problem and enhance our computer security in order to protect our customers’ data. We are dedicating significant resources to evaluate the issue."

"I want our customers to know how much I personally regret any difficulties you may experience as a result of the unauthorized intrusion into our computer systems," Meyerowitz said.

Meyerowitz also claimed that customers were not demonstrating any anger towards TJX by taking their business away, as the company enjoyed strong sales gains throughout January, and posted a fourth-quarter increase for sales in 2006.

However, TJX also reported a 29 percent decline in earnings for fourth-quarter 2006, and the company stock fell 1.54 percent after the first-quarter earnings report, settling at $28.18 a share.

TJX said that costs from the data breach, including the investigation, totaled $5 million, but could not estimate how that would affect future earnings. TJX first detected the breach in December 2006, but delayed reporting it until mid-January, claiming that it needed time for its outside investigators to proceed.

TJX may not be worrying about angry customers leaving stores, but it is facing a class action lawsuit in Massachusetts over the breach. Sixty of the state's 205 banks reported having to cancel and reissue thousands of debit and credit cards to customers who may have been compromised as a result of the TJX breach.

The Attorneys General of Massachusetts and Rhode Island have opened formal investigations into the conduct of TJX over the breach. Massachusetts AG Martha Coakley, herself a victim of identity theft, has promised to make cracking down on the crime a priority of her tenure.

The revelations are similar to the latest breach of data security at the Veterans' Administration. A hard drive containing information on 1.8 million VA patients and doctors was reported missing from an Alabama hospital on January 22, but was not reported until several days later.

Even then, the drive was estimated to have only 48,000 records on it, and it was not until two weeks after that when the VA finally admitted the actual number.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |