TJX data breach may involve 94 million credit cards

SAN FRANCISCO -- The massive computer data breach at TJX tjx may be worse than expected: At least 94 million Visa and MasterCard accounts — nearly double the previous estimate by the retailer — could have been exposed, new court files say.

The filings, which cite security officials at Visa and MasterCard, are part of a lawsuit filed by several banks and banking associations against TJX and Fifth Third Bancorp, the bank that handled its card transactions, in an attempt to recover breach-related losses.

The depositions say fraud-related losses of Visa cards range from $68 million to $83 million and will rise as thieves continue to use data from compromised cards.

The latest estimate is significantly higher than TJX's original disclosure of 45.7 million accounts, in what is generally acknowledged by security experts as the biggest data breach disclosed.

TJX said it stands by its original figure.

In an Aug. 31 deposition that was unsealed in federal court in Boston late Tuesday, Joseph Majka, Visa USA's vice president of investigations and fraud management, said the association alerted card-issuing banks and other institutions about 65 million Visa accounts that may have been compromised.

"I'm not sure if this is, in fact, the final number," said Majka, who added that Visa had fraud reports from 13 countries — most of them from the USA.

Visa declined comment Wednesday.

MasterCard security official Neil Maguire said in a Sept. 27 deposition that his card association believed it had "roughly 29 million" potentially exposed cards. He did not give a dollar estimate of fraud involving MasterCard accounts in the portion of his deposition that was unsealed.

MasterCard had no comment.

TJX spokeswoman Sherry Lang declined to comment on the court filings. But she said the company is sticking with its figure. She said 75% of those accounts had expired or the data were masked — appearing as asterisks instead of numbers — at the time of the theft.

No one has been arrested for breaking into TJX's computer systems. Six people were convicted in Florida this year for their roles in a ring that used stolen TJX customer data to buy gift cards and merchandise worth at least $1 million.

The TJX digital break-in has been the whopper among a series of breaches that have bedeviled companies and vexed their customers.

Last month, a contractor for The Gap was blamed for losing laptops containing the data of about 800,000 people who applied for jobs at the clothing retailer.