11 Charged in TJX Network Security Breach Identity Theft

BOSTON (Reuters)—The U.S. government charged 11 people on Tuesday
with stealing tens of millions of credit and debit card numbers from
major retailers including TJX Cos Inc, in one of the largest reported
identity-theft incidents on record.

The U.S. Attorney in Boston said those charged were involved in the
theft of more than 40 million credit and debit card numbers from
retailers that included: BJ’s Wholesale Club, OfficeMax, Boston Market,
Barnes & Noble, Sports Authority, Forever 21 and DSW Inc.

Framingham, Massachusetts-based TJX, which owns the Marshall’s and
TJ Maxx chains, was the hardest hit by the ring, acknowledging in March
2007 that information from 45.7 million credit cards was stolen from
its computers.

The charges target three people from the United States, three from
the Ukraine, two from China, one from Estonia and one from Belarus.

The ring, which authorities said was headed by a Miami man named
Albert Gonzalez, hacked into the retailers’ computer networks to
capture the numbers, which they then stored on computer servers in the
United States and Eastern Europe.

They then sold the information to people in the United States and
Europe, who used it to withdraw tens of thousands of dollars at a time
from automated teller machines, authorities said.

"This case clearly shows how strokes on a keyboard with a criminal
purpose can have costly results," Michael Sullivan, U.S. Attorney in
Boston, said in a statement. "Consumers, companies and governments from
around the world must further develop ways to protect our sensitive
personal and business information."

Gonzalez, who is being held by New York authorities on another
computer hacking-related charge, was charged with computer fraud, wire
fraud, access-device fraud, aggravated identity theft and conspiracy,
authorities said.

He faces life in prison if convicted of all charges.

TJX has agreed to pay more than $60 million to credit-card networks
Visa Inc and MasterCard Inc to settle complaints related to the
incident, which is one of the largest on record based on the number of
accounts involved.

© Thomson Reuters 2008. All rights reserved.
Users may download and print extracts of content from this website for
their own personal and non-commercial use only. Republication or
redistribution of Thomson Reuters content, including by framing or
similar means, is expressly prohibited without the prior written
consent of Thomson Reuters.