Stolen TJX Data Used in $8M Scheme Before Breach Discovery

Information stolen from the systems of massive retailer TJX was being used fraudulently in November 2006 in an $8 million gift card scheme, one month before TJX officials said they learned of the breach, according to Florida law enforcement officials.

The significance of this new TJX detail—discovered as Florida authorities issued arrest warrants for 10 suspects and took six of them into custody—is not clear, but it might yield clues as to how TJX learned of the breach.

The $16 billion retail chain has officially said that a huge amount of information was accessed as early as 2005 (with some of the captured data dating back to 2003), but that TJX officials didn’t learn of the breach until December 2006. The company didn’t announce the breach until mid-January 2007 due to—according to one credit-card source—a request from the Secret Service because it was actively pursuing a suspect.

Read more here about the TJX probe.

The Florida information raises the possibility that whoever took the data had decided to start using it late last year. Law enforcement pursuing those cases would have found TJX as the common link, potentially prompting TJX to more closely examine its systems.

In the Florida case, a group used TJX credit- and debit-card information to do a low-tech clone scam to the tune of about $8 million. The group is accused of taking credit cards and applying new magstripes containing the stolen data. It is not clear if the credit cards displayed the same numbers in plastic embossing that were in the magstripe, said Dominick Pape, the special agent in charge for the Florida Department of Law Enforcement.

Read the full story on eWEEK.com: Stolen TJX Data Used in $8M Scheme Before Breach Discovery