TK Maxx Hackers Stole Millions of Credit Card Details ; BUSINESS

Mar 30, 02:02 AM

Current Headlines: By Stephen Foley

Shoppers at the discount chain TK Maxx in the UK have unwittingly been caught up in the biggest ever credit card security breach, where hackers stole details of at least 45.7 million customers' accounts.

The chain's US parent company, TJX, has admitted that sophisticated fraudsters were able to access its computer systems almost at will, and that it may never know the full extent of the information that has been stolen.

Customers shopping at its stores in the US, Canada, Puerto Rico, the UK and Ireland were all targeted, and the hackers were able to see unencrypted credit card data as payments were processed between store tills and the banking network. In hundreds of thousands of cases in the North American stores, the thieves were also able to get access to customers' addresses and other personal information that could allow them to commit identity theft.

Fraudsters using the stolen credit card details allegedly went on an $8m ([pound]4.1m) spending spree in Florida, according to the state's law enforcement department, which arrested six people earlier this month and issued warrants for four others.

TJX first admitted a security breach in January this year, but it has only now come clean on the full extent of the attack. An update in its annual report revealed that it now believes its computer systems were first accessed by an unau-thorised intruder in July 2005, on subsequent dates in 2005 and from mid-May 2006 to mid- January 2007.

It said some 45.6m credit card numbers were stolen in 2005, and it has identified at least another 132,000 taken in 2006, although that figure may be a vast underestimate. The hackers were using increasingly sophisticated technology to cover their tracks, it said. "We are continuing to try to identify information stolen in the computer intrusion [but] we believe that we may never be able to identify much of the information believed stolen."

Even on the figures disclosed so far, the data theft is the largest ever. It eclipses the 40m records compromised in a 2005 security breach at CardSystems Solutions, a credit and debit card payment processing business.

TJX owns the TK Maxx chain, which has over 200 stores in the UK and Ireland. The company has more than 2,000 stores in total across the world. Computer systems in Framingham, Massachusetts, and in Watford in the UK were targeted by hackers, who appear to have been so successful that they were able to transfer data between the two sites. Most of the data on TJX's own systems was either encrypted or did not contain important PIN numbers that would help the hackers, the company said, so most customers are not at risk of identity theft.

The suspects arrested in Florida were travelling throughout the state buying large quantities of Wal-Mart gift cards with the stolen credit card accounts, and then using the gift cards at other stores to buy expensive electrical goods. TJX said its internal investigation has already cost it $5m, but it has already attracted lawsuits from customers and may have to compensate credit card companies.

(c) 2007 Independent, The; London (UK). Provided by ProQuest Information and Learning. All rights Reserved.