TJX Identity Thieves get Maxx for Minimum

By Rich Silverman

TJX Companies, parent of retailers T.J. Maxx, Marshalls, HomeGoods and A.J. Wright, announced Wednesday that the theft of data about its customers, including credit card, debit card and check information, started 10 months earlier than it originally believed to be the case.

The company first thought that hackers accessed the information from May 2006 through January of 2007. But now the company says that credit card and debit card transaction data at its U.S. and Puerto Rican stores also was compromised during the period January 2003 through June 2004, as were credit card transactions at its Canadian operations.

The company also found some evidence that transaction data from its T.K. Maxx stores in Ireland and Britain may also have been accessed, but there is no evidence so far that data was actually stolen. TJX first publicly revealed the theft of its data on January 17th.

According to the Massachusetts Banking Association (MBA), which represents the interests of banks in that state there have been reports of fraud related to the theft in Louisiana, Florida and Georgia in the U.S. and as far away as Hong Kong and Sweden. TJX Companies is headquartered just west of Boston.

Driver’s license data was also compromised in the 2003 – 2004 thefts, according to the company. It collects that data when customers make returns without a receipt.

TJX Companies CEO and President Carol Meyrowitz said in a statement "We are dedicating substantial resources to investigating and evaluating the intrusion, which, given the nature of the breach, the size and international scope of our operations, and the complexity of the way credit card transactions are processed, is, by necessity, taking time."

The company is working with a variety of law enforcement agencies, including the Secret Service and the Royal Canadian Mounted Police to investigate the data thefts. Meyrowitz also noted that the company is working with more than 50 computer security experts.

The company knew about the data thefts for a month before disclosing them publicly, according to a recent posting on businessweek.com, but delayed releasing the information at the request of law enforcement officials, to give them time to work with security experts.

The MBA is pushing for legislation that would require prompt disclosure when personally identifiable information is compromised, and is seeking to make companies financially responsible for such incidents.

Although more than 30 states have rules requiring prompt disclosure, Massachusetts does not. State lawmakers there are planning to reintroduce legislation that would require disclosure within five days of the discovery of a breach of personal data.

Daniel J. Forte, the MBA’s chief executive officer noted "By not disclosing which firm caused the breach, or quickly disclosing it, consumers are needlessly troubled and might feel compelled to take unwarranted action if they’re left in the dark." Forte added that local banks bear the cost of replacing cards and covering the cost of fraud.

Massachusetts Attorney General Martha Coakley is also spearheading a civil investigation into the matter.

All the publicity about the data thefts doesn’t appear to have hurt the company financially. Its fiscal fourth quarter 2006 sales were up 5% during the fourth quarter, which ended 10 days after the disclosure of the thefts, and sales have remained strong, according to TJX executives.

The company reported that costs related to the data thefts total $5 million, or about 1 cent per share. Sales at its almost 2000 retail outlets for fiscal 2007 were $17.4 billion, an increase of 9 percent from the previous year. Earnings were $738 million, up from $690.4 million a year earlier.