March 29, 2007 9:28 AM PDT

TJX says 45.7 million customer records were compromised

TJX Companies said 45.7 million accounts were compromised over nearly a two-year period, in an update Wednesday of an investigation into a data breach of customer records.

The scope of the breach, which was initially disclosed in January, is far wider than previously believed.

"This is the largest security breach we've ever had worldwide," said Avivah Litan, an analyst with research firm Gartner. "There was a case at CardSystems where 40 million records were exposed, but this one looks like it was a case where the information was stolen."

TJX, which operates such discount retail chains as T.J. Maxx and Marshalls in the U.S., released additional details of the breach in a filing with the Securities and Exchange Commission.

In its filing, TJX noted cyberthieves first accessed its computer systems in July 2005 and installed software to harvest such sensitive customer information as account information, names and addresses, drivers' license numbers and military and state identification. The breach continued through mid-January 2007.

Accounts and transactions affected included credit and debit card transactions, as well as checks and returned merchandise without receipts at the company's Marshalls, T.J. Maxx, HomeGoods and A.J. Wright stores in the U.S. and Puerto Rico. Credit card transactions at TJX's Winners and HomeSense stores in Canada, as well as credit and debit card transactions at its T.K. Maxx stores in Ireland and the U.K. were also compromised.

TJX rang up a pre-tax charge of $5 million in the fourth quarter to deal with the computer breach, which included the costs associated with investigating the issues, improving its security systems and notifying customers.

Those costs are likely to increase, given the multiple lawsuits customers have filed and investigations launched by a number of government agencies. According to the SEC filing, a multistate investigation is currently under way that encompasses 30 states, and the Federal Trade Commission is also reviewing whether TJX violated laws pertaining to consumer protection. In Canada, several privacy commissioner offices in various provinces are also reviewing the matter.

The security breach involving CardSystems, a third-party processor of payment data for banks and merchants, resulted in the exposure of credit card numbers for 40 million accounts--a figure comparable to the TJX case. Other notable cases include data broker ChoicePoint, which affected an estimated 145,000 Americans, and the University of California at Los Angeles, in which 800,000 people had their information compromised after a security breach.

In the case of TJX, Litan suspects it was a case where attackers gained access through a wireless regional hub for the company's store controllers that handle the point-of-sale system. From there, the attackers may have been able to work their way into TJX's central system, she noted.

"Most retailers aren't looking at their point-of-sale system," Litan said. "Most enterprises tend to forget about the devices hanging off of their networks. What happened here may not be all that uncommon."

See more CNET content tagged:
breach, CardSystems Solutions Inc., security breach, debit card, investigation

3 comments

Join the conversation!
Add your comment
30% Of Working Population!!!
Forty five million people is about 1/3 of the current U.S. workforce. So look to your co-worker on your left, your co-worker on your right, and know that one of you will have your financial life made a living hell by TJ Hacks for the next 10 years.

Shop at retail stores? My advice is to buy with cash for any tranaction under $100. This will also save you from the retail stores 35% credit card rates too. Stores will hate you for this -- Mervyn's tries to shill me into signing up for their CC every time I buy something, but screw them!
Posted by Stating (869 comments )
Reply Link Flag
pathetic security
Their primary data center should've been protected from something like this, and every IT professional knows that wireless is the easy way into every network. A wireless connection is how hackers got into Microsoft several years ago. A MS employee was working from home with an open wireless connection - what an idiot. TJX should fire their entire IT department and start over.
Posted by lleather (19 comments )
Reply Link Flag
The intrusion detection illusion
What's the matter? All the greatest IDS/IPS appliances, Firewalls, Anti-malware crap in-place and the company still got exploited? I'm not surprised.

IT managers are basically lazy. They spend huge dollars on control devices, train users and stick them in the control room. The signature baselines take care of the majority of mundane issues and people just basically don't care. The equipment was bought to do most of the work. The same story happens over and over again.

Exploits occur through laziness and over-reliance on technology. If nobody understands what is normal on the network how can you tell what's abnormal? Today's hacks are subtle and take advantage of holes in processes, technology and by exploiting social conditions. No signature can identify and threat if it isn't programmed to do so! HELLO!

Big appliances and big dollar expenditures are the life blood for most large company IT managers. They need to justify their salaries, staff and budgets and continue to pile box after box into their premises. Are the more secure? Yes, but at a considerably inflated cost.

IMHO, it's a very simple matter of clearly defining what should be on the network, coming in and going out, on every port and noting every protocol. In so doing the anomalies tend to stand out much more easily than simply trying to control everything. You can't spend your way to a secure network.
Posted by Schratboy (122 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.