The TK Maxx data breach affected more than 94 million credit and debit card accounts, more than twice the number acknowledged by the big retailer, a group of banks allege in a new court filing.
TK Maxx's parent compay TJX has previously acknowledged that 45.7 million card numbers were stolen in data breaches beginning in 2005. But a group of banks suing TJX over the costs of the breach claimed in a court filing that the real total includes 65 million Visa account numbers and 29 million MasterCard numbers, the Boston Globe reported. The banks based this estimate on “sealed testimony taken from officials” at Visa and MasterCard, the report says.
The court filing estimates damages to banks and other institutions that issued stolen Visa cards of up to £42m.
A spokeswoman for Fifth Third of Ohio, a bank that handled many TJX transactions, acknowledged filing the new court documents in US District Court in Boston, but didn’t discuss the case in detail.
Joining Fifth Third in the lawsuit are the Massachusetts Bankers Association and other plaintiffs, the Globe said. The banks are claiming TJX mishandled security.
Bruce Spitzer, spokesman for the Massachusetts Bankers Association, confirmed that the details revealed by the Boston Globe were accurate, but said “there’s not a lot we’re saying about [the case publicly].”
A settlement offer TJX made to appease data breach victims includes credit monitoring and identity theft insurance – but only for 455,000 customers.
TJX has also offered store vouchers worth £15 to customers who lost time or money due to the theft of card data, and said would hold a three-day sale for all customers in which would be reduced by 15%.
In August, police in Turkey arrested a man allegedly trying to sell data hacked and stolen during the theft of customer records from TJX.