A Little TJX Dishonesty

What's the latest on the TJX security breach?

Information Week had a couple of notes. First on August 13:

The south Florida arrests resulted in the recovery of about 200,000 stolen credit card account numbers responsible for fraud losses roughly calculated to be more than $75 million. Agents also seized two pickup trucks, $10,000 cash, and a handgun in connection with the case.

This was the second high-profile bust related to the TJX breach. In March, the Gainesville Police Department and Florida Department of Law Enforcement caught six people with fake credit cards, created using stolen TJX data, who had bought $8 million worth of gift cards at Wal-Mart and Sam's Club stores in 50 of Florida's 67 counties.

And then there is this on August 22:

A Ukrainian man, who was arrested in a Turkish nightclub, allegedly was selling credit card information stolen during the massive security breach at TJX, the parent company of retailer T.J. Maxx.

But say you don't read IT trade magazines, instead you are a highly valued TJX customer. What does TJX tell you? Their latest update is still 21 Feb 2007. Here is what CEO Carol Meyrowitz writes:

Since we learned of the probability of a breach in mid-December 2006, we have cooperated with law enforcement as well as with the banks and credit card companies that process our customer transactions. Further, we have established customer helplines in three countries and are making available a great deal of helpful information on our company websites. (emphasis added)

Their FAQ page states:

We do not know whether any fraudulent use has occurred or if so, to what extent. Law enforcement has advised us that they are investigating what may be fraudulent use of information stolen from our systems. We have provided extensive transaction information to the banks and payment card companies, but they have not shared details of possible fraudulent use with us.

Maybe the above statements passed muster with TJX lawyers in February, but six months and $83M later what should they be saying?

Originally posted in UNCoRRELATED August 30, 2007