Feeds

TJX breach was twice as big as admitted, banks say

World's biggest credit card heist now estimated at 94 million accounts

5 things you didn’t know about cloud backup

The world's largest credit card heist may be bigger than we thought. Much bigger.

According to court documents filed by a group of banks, more than 94 million accounts fell into the hands of criminals as a result of a massive security breach suffered by TJX, the Massachusetts-based retailer.

That's more than double what TJX fessed up to in March, when it estimated some 45.7 million card numbers were stolen during a 17-month span in which criminals had almost unfettered access to the company's back-end systems. Going by the smaller estimate, TJX still presided over the largest data security SNAFU in history. But credit card issuers are accusing TJX of employing fuzzy math in an attempt to contain the damage.

"Unlike other limited data breaches where 'pastime hackers' may have accessed data with no intention to commit fraud, in this case it is beyond doubt that there is an extremely high risk that the compromised data will be used for illegal purposes," read the document, filed Tuesday in US District Court in Boston. "Faced with overwhelming exposure to losses it created, TJX continues to downplay the seriousness of the situation."

TJX officials didn't return a call requesting comment for this story.

The new figures may mean TJX will have to pay more than previously estimated to clean up the mess. According to the document, Visa has incurred fraud losses of $68m to $83m resulting from the theft of 65 million accounts. That calculates to a cost of $1.04 to $1.28 per card. Applying the same rate to the 29 million MasterCard numbers lost, the total fraud losses alone could top more than $120m.

Research firms have estimated the total loss from the breach could reach $1bn once settlements, once legal settlements and lost sales are tallied. But that figure was at least partly based on the belief that fewer than 46 million accounts were intercepted.

TJX has taken serious flack for allowing the breach to happen. Last month, Canada's privacy commissioner criticized the company for collecting too much data and using inadequate means of protecting it. According to the commissioner's report, TJX believes intruders gained access through company Wi-Fi networks that employed Wired Equivalent Privacy (WEP) as the sole means of securing the system.

Security pros have long known the encryption protocol can be cracked through brute force attacks, sometimes in a matter of minutes.

So far, there have been no arrests directly associated with the breach. However, six people detained in Florida after using credit card information stolen from TJX later pleaded guilty to fraud-related charges.

US law enforcement officials have also taken a keen interest in a Ukrainian man arrested for selling stolen credit card numbers in online forums. Many of the stolen accounts belonged to customers whose credentials were siphoned out of TJX's rather porous network.

The plaintiff's filings came in a legal tussle over whether the bank's lawsuit should qualify as a class action. TJX is arguing the banks don't qualify as a class, an outcome that would significantly increase the costs of pursuing the case. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.