11 Charged in TJX Network Security Breach Identity Theft

BOSTON (Reuters)—The U.S. government charged 11 people on Tuesday with stealing tens of millions of credit and debit card numbers from major retailers including TJX Cos Inc, in one of the largest reported identity-theft incidents on record.

The U.S. Attorney in Boston said those charged were involved in the theft of more than 40 million credit and debit card numbers from retailers that included: BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW Inc.

Framingham, Massachusetts-based TJX, which owns the Marshall's and TJ Maxx chains, was the hardest hit by the ring, acknowledging in March 2007 that information from 45.7 million credit cards was stolen from its computers.

The charges target three people from the United States, three from the Ukraine, two from China, one from Estonia and one from Belarus.

The ring, which authorities said was headed by a Miami man named Albert Gonzalez, hacked into the retailers' computer networks to capture the numbers, which they then stored on computer servers in the United States and Eastern Europe.

They then sold the information to people in the United States and Europe, who used it to withdraw tens of thousands of dollars at a time from automated teller machines, authorities said.

"This case clearly shows how strokes on a keyboard with a criminal purpose can have costly results," Michael Sullivan, U.S. Attorney in Boston, said in a statement. "Consumers, companies and governments from around the world must further develop ways to protect our sensitive personal and business information."

Gonzalez, who is being held by New York authorities on another computer hacking-related charge, was charged with computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, authorities said.

He faces life in prison if convicted of all charges.

TJX has agreed to pay more than $60 million to credit-card networks Visa Inc and MasterCard Inc to settle complaints related to the incident, which is one of the largest on record based on the number of accounts involved.

© Thomson Reuters 2008. All rights reserved. Users may download and print extracts of content from this website for their own personal and non-commercial use only. Republication or redistribution of Thomson Reuters content, including by framing or similar means, is expressly prohibited without the prior written consent of Thomson Reuters.