TJX breach may be double previous estimate

At least 94 million Visa and MasterCard accounts may have been exposed to potential fraud in a data breach at TJX Cos., nearly double the previous estimate by the discount retailer.

The figure was included in court filings this week that cited executives from the credit card associations.

The filings in a bank case against TJX indicated that fraud-related losses involving Visa cards alone range from $68 million to $83 million, spread across 13 countries. One filing warned that the total would rise as thieves continued to use data from compromised cards.

“You know, these are going to be sold off for a period of time in the future, so it’s going to continue for some time out there,” Joseph Majka, Visa USA’s vice president of investigations and fraud management, said in court documents unsealed late Tuesday.

Depositions of security executives at Visa and MasterCard Inc., the two biggest credit card associations, suggest that the breach was far bigger than TJX has indicated. Even before the latest numbers, independent organizations that track data breaches had called the case the largest ever.

TJX said in March that at least 45.7 million of its shoppers’ cards had been compromised, although it acknowledged that it might never learn the total number. However, the Framingham, Mass.-based owner of 2,500 stores including T.J. Maxx and Marshalls has said about three-quarters of the cards either had expired by the time of the theft or had masked data in the magnetic strip, meaning that the information was stored as asterisks rather than numbers.

In an Aug. 31 deposition with an attorney for banks suing to recover breach-related losses, Visa’s Majka said the association had alerted card-issuing banks and other institutions about 65 million Visa card accounts that might have been compromised. That number was as of June, he said.

“I’m not sure if this is, in fact, the final number,” he said.

A Visa spokesman declined to comment further Wednesday.

Neil Maguire, a MasterCard security executive, said in a Sept. 27 deposition that his card association believed that it had “roughly 29 million” potentially exposed cards. In the portion of Maguire’s deposition that has been unsealed, he did not give a dollar estimate of fraud involving MasterCard accounts.

Chris Harrall, a MasterCard spokesman, declined to comment because the matter involved ongoing litigation.

TJX spokeswoman Sherry Lang also declined to comment.

No arrests have been made of people suspected to have broken into TJX’s systems.

Last month, a Canadian government investigation concluded that hackers intercepted wireless transfers of customer information at two Miami-area Marshalls stores. The break-in gave hackers undetected access to TJX’s central databases for a year and a half, starting in July 2005.