TJX hack thought biggest ever
Over 45 million card numbers gathered in massive breach.
A report into a security breach at major US retailer TJX has revealed a lengthy and sophisticated
attack which scooped vast amounts of sensitive personal data on users of the company's chains of clothing
and home stores, believed to be the largest ever haul of information from a computer hack.
The TJX group, which includes the T.J. Maxx and Marshalls chains in the US and
T.K. Maxx in the UK and Ireland, has issued its annual report, including lengthy analysis of
the hacking incident first discovered in December last year and disclosed publicly in February.
Although details remain shadowy, with little known of the attacker's identity or methods, it appears that
payment card detail for at least 45.7 million of the chain's shoppers was taken in an 18-month period in
which the hacker had considerable access to the company's systems.
The intrusion was first spotted on December 18th 2006, and reported to authorities on December 22nd.
Subsequent investigations discovered that the attacker may have first broken into TJX systems as
early as July 2005, with data stored on servers in Framingham, Massachusets, and Watford in the UK,
accessed and stolen. The full extent of the data theft may remain unknown, as much of the data may have
been routinely deleted by the firm after it was gathered by the hacker, who also used advanced
encryption to hide his traces and may have broken encryption systems used by TJX to store their
data.
Many of the cards compromised by the attack, used for transactions at TJX's 2,500 cut-price stores
from December 31st 2002 onward, have since expired, no PIN data is thought to have been gathered and
no card information at all is believed to have been taken from the UK-based systems. However,
large quantities of other sensitive data is also thought to have been taken, including the names and
addresses, and possibly driving licence numbers, of as many as 450,000 people.
The incident has already cost the firm $5 million in expenses related to the investigation, cleanup and
shoring up of security measures, with future costs including compensating potentially huge numbers of
fraud victims impossible to estimate. TJX has vowed to continue its attempts to track down the
hacker and to ensure the future security of its networks. The full report can be found (in PDF format)
here
(see pages 7-10).
30 March 2007
Tags:
virus
del.icio.us 
digg this
