For the first time since unveiling the security breach more than two months ago, TJX put a number on how much card data was compromised : 45.7 milions - and it's a number TJX Cos. admits could go still higher.
"It's not clear when data was deleted, it's not clear who had access to what, and it's not clear whether the data kept in all these files was encrypted, so it's very hard to know how big this was," declared Deepak Taneja, chief executive of Aveksa, a Waltham, Mass.-based information security company.
The case has forced banks to reissue cards to customers as a safety measure against further fraud beyond cases detected as far away as Sweden and Hong Kong, according to the Massachussets Bankers Association, which is tracking fraud reports linked to Framingham, Mass.-based TJX, parent company of stores across North America and the United Kingdom.
The only arrests believed tied to the case involve a gift card scam in which 10 people are suspected of buying data from the TJX hackers to pay for Wal-Mart gift cards in northern Florida. The group - who aren't believed to have hacked TJX - then used the cards to buy $1 million worth of electronics and jewelry at Wal-Mart's Sam's Club stores, according to Gainesville, Fla., police.
Information from 45.7 million cards was stolen from transactions beginning in January 2003 and ending Nov. 23 of that year, TJX said in the filing with the Securities and Exchange Commission after business hours Wednesday. TJX did not estimate the number of cards from which information was stolen for transactions occurring from Nov. 24, 2003, to June 28, 2004.
TJX said about three-quarters of the 45.7 million cards had either expired at the time of the theft, or the stolen information didn't include security code data from the cards' magnetic stripes. Starting in September 2003, TJX began masking the codes by storing them in computers as asterisks rather than numbers, the company said.
The filing also said another 455,000 customers who returned products with no receipts had their data stolen, including driver's license numbers. |
