Thought this news was worth flagging up here - especially as it appears to be slow hitting the UK mainstream news!
http://business.guardian.co.uk/story/0,,2046153,00.html
Computer hackers targeting the cut-price fashion retailer TK Maxx have stolen information from 45.7m credit and debit cards on both sides of the Atlantic, in one of the biggest electronic heists of its kind.
TK Maxx's American parent company, TJX, revealed the extent of the "unauthorised intrusion" in its annual report yesterday, which said somebody had used sophisticated software to access its data centres in Watford and in Framingham, near Boston.
The hacker was able to snatch potentially sensitive details from four years of transactions up to December last year, including information from shoppers who visited the company's 210 department stores in Britain.
"We suspect that customer data for payment card transactions at TK Maxx stores in the UK and Ireland has been stolen," said the company. "We suspect that these files contained payment card transaction data, some or all of which could have been unencrypted and unmasked."
Names, card numbers and personal data were stolen - including, in the case of American shoppers, social security numbers.
The company said there was evidence that the information had been used for fraudulent transactions. Six people were charged in Florida last week with using TJX data to buy $1m in Wal-Mart gift cards which were used to pay for electronics and jewellery.
Of the details stolen in both Britain and America, 30.6m came from cards which had expired at the time of the breach, while 15m were unexpired. Of those still valid, 3.8m had "masked" or encrypted information but 11.2m had clearly accessible data.
TJX became suspicious a week before Christmas when it discovered unfamiliar software on its computer systems. The company called in experts from IBM and General Dynamics and notified the US secret service a few days later.
When the scale of the breach became clear, TJX informed the Metropolitan Police and Britain's information commissioner, in addition to law enforcement bodies in the US and Canada.
The company is already facing lawsuits from angry shoppers, banks and credit card companies and has set aside $5m to cover the cost of the investigation.
Banks, which have been forced to re-issue debit and credit cards to affected customers, have been critical of the company, which initially disclosed that it had a problem in January but then said that the amount of information stolen was "substantially less than millions".
Bruce Spitzer, a spokesman for the Massachusetts Bankers Association, told the Boston Herald that the firm had not been very forthcoming about the size of the breach, adding: "They didn't have good systems in December, and obviously they didn't have them for years before."
The US firm opened its first British store in 1994 and has become renowned for offering bargain prices on clothing from designer labels such as Armani, Calvin Klein and DKNY.
In a message on TK Maxx's website, the group's chief executive, Carol Meyrowitz, has offered a personal apology to customers and has provided a free phone number for anybody who believes they may have been affected: 0800 779015.