TJX Companies (T.J. Maxx) card breach

On 17 January 2007, the off-price retailer The TJX Companies — parent of T.J. Maxx, Marshalls, HomeGoods, and the European TK Maxx chain — disclosed that intruders had been inside its systems and stolen payment-card data. As the investigation deepened, the scale became historic: an estimated 94 million payment-card records compromised over an intrusion that ran roughly 18 months before detection, making it the largest U.S. retail data breach known at the time.

What happened

The intrusion began not at corporate headquarters but in a store parking lot. In July 2005, attackers used wardriving — scanning for wireless networks from outside the building — to reach a weakly-protected in-store Wi-Fi network at a Marshalls outlet in Minnesota. The network relied on the obsolete WEP encryption standard, which the crew defeated.

From that beachhead the attackers moved laterally into TJX's central systems in Framingham, Massachusetts, where they installed packet-sniffer software that captured cardholder data as it flowed across the network — much of it stored or transmitted with inadequate encryption. The intruders also harvested data from transactions reaching back years that TJX had retained longer than card-industry rules permitted.

How it was run

The operation was led by Albert Gonzalez, a former U.S. Secret Service informant who simultaneously ran one of the most prolific card-theft rings of the decade. The same crew was later tied to breaches at Heartland Payment Systems, Hannaford, and other retailers. Stolen card numbers were encoded onto blank plastic and used to buy gift cards and merchandise, or sold through carding forums.

Impact

• An estimated 94 million payment-card records were exposed — names, card numbers, and in some cases driver's-license data tied to merchandise returns.
• TJX's reported total cost exceeded $256 million, covering remediation, legal settlements, and customer compensation.
• TJX settled with 41 state attorneys general for $9.75 million and resolved consumer class actions valued at over $200 million.
• Albert Gonzalez was indicted in 2008 and sentenced in 2010 to 20 years in federal prison.

Why it matters

The TJX breach was a turning point for the Payment Card Industry Data Security Standard (PCI DSS). It exposed how weak wireless encryption, excessive data retention, and unencrypted internal traffic could combine into a catastrophic exposure — and it pushed retailers and acquirers to treat PCI compliance as a board-level obligation rather than a checkbox. For years afterward, TJX served as the canonical example of how a single soft perimeter, a store Wi-Fi access point, could open the door to a nationwide chain's entire payment infrastructure.