The TJX Companies, the discount retailer that owns the TJ Maxx stores in the US and TK Maxx stores in the UK, said on Wednesday it had suffered a breach of data security that appeared to be one of the most serious reported by a big retailer.
The company said it had “suffered an unauthorised intrusion into its computer systems that process and store information related to customer transactions” and that “the full extent of the theft and affected customers” was not yet known.
It said it discovered the data intrusion in December, but had not made the breach publicly known immediately at the request of the police.
It said the data lost, comprising credit and debit card payment information, affected its chains in the US, and might also involve customers of its TK Maxx stores in the UK and Ireland.
The retailer said it had taken steps to “significantly strengthen the security of its computer systems”. It also said it had identified a limited number of customer accounts and names together with driving licence numbers that had been removed from the system, but left open the possibility that more information might have been compromised. “TJX does not know if it will be able to identify additional information of specific customers that may have been taken,” the company said.
Ben Cammarata, acting chief executive officer of The TJX Companies, said the company was strongly recommending that customers “carefully review their credit card and debit card statements and other account information for unauthorised use”.
The data affected covered sales at several of the company’s chains in 2003 and 2006. TJX, which has annual sales of more than $16bn, said it did not have enough information to estimate the extent of the financial costs it would incur.
In 2005, DSW, the discount shoe retailer, lost information to hackers on 1.4m credit cards and 96,000 cheques from 108 of its US stores, a security breach that helped spur efforts in the US Congress to tighten data security regulation.
Get alerts on Travel & leisure industry when a new story is published