Millions Have Bank Details Stolen in World's Biggest Ever Credit Card Scam

Mar 30, 05:42 AM

Current Headlines: By SHAN ROSS

MILLIONS of British and American shoppers have had their bank details stolen in what is believed to be the world's biggest card heist, it emerged last night.

Hackers stole 45.7 million credit and debit-card numbers from the British and US computer systems of the retailer which owns the discount clothing chain TK Maxx.

The American parent company last night said it did not know how many of the cardholders affected were shoppers at TK Maxx's 210 stores in Britain and Ireland.

However, police south of the Border are investigating, because some details were stored on a computer system in Watford.

The data was accessed over a 16-month period and covers transactions dating as far back as December 2002.

The company first discovered suspicious software on its system last December and revealed it suspected numbers had been stolen in January, but has only now provided details of the full scale of the theft.

TJX, the US-based parent company of the bargain chain, said much of the transaction data was deleted before the breach was detected, making it impossible to know exactly how many cards were affected.

"It's the biggest card heist ever. This was obviously done over a long period of time, in many locations. It's done considerable damage," said Avivah Litan, of Gartner, a US-based IT consultancy firm.

Following the discovery, TJX hired investigators from General Dynamics and IBM, who determined that the computer systems had been infiltrated and that an "intruder" remained in the systems.

Some banks and card companies have already found what they consider to be "preliminary evidence" of possible fraud.

Law-enforcement authorities are investigating the fraudulent use of payment-card information believed to have been stolen.

Sherry Lang, a spokeswoman for TJX, said yesterday that about 75 per cent of the compromised cards either were expired or had data in the magnetic stripe masked, meaning the information was stored as asterisks, rather than numbers.

As well as card numbers, personal information provided by around 451,000 American customers who returned goods without a receipt was also stolen.

The firm does not believe return transactions in the UK were affected, or that PIN numbers were accessed, because none are stored on the Watford system.

Scotland Yard said it had been informed of the theft by TJX but that any investigation would fall under the jurisdiction of Hertfordshire Police.

No-one was available to comment at the force.

The FBI, the US Secret Service and state law-enforcement agencies are all investigating in the United States.

Lawsuits have also been filed in the US from individuals and banks, accusing the firm of failing to safeguard private data and delaying disclosure of the problem.

A special section on the firm's website dealing with the security breach yesterday advised customers to scrutinise their bank statements for evidence of fraud.

In its statement, TJX said for the first time that 18 December, 2006, was the date it first learned that there was suspicious software on its computer system.

TJX said it believed hackers invaded its systems in July 2005, on later dates in 2005 and also from mid-May 2006 to mid-January this year.

Last week police charged six people in Florida with using credit- card numbers that investigators believe were stolen from a TJX database to buy about GBP 500,000 worth of electronics and jewellery with gift vouchers.

The gift cards had been purchased from Wal-Mart stores, and were used to acquire goods from massive "warehouse" stores. Detectives have said they believe the Florida suspects were not the actual hackers but bought the card numbers from someone else.

(c) 2007 Scotsman, The. Provided by ProQuest Information and Learning. All rights Reserved.