TODAY NEWS

11 Charged in Theft of 40 Million Card Numbers

By REUTERS

Published: August 5, 2008
BOSTON — The Justice Department said on Tuesday that it had charged 11 people in the theft of tens of millions of credit and debit card numbers of customers shopping at major retailers, including TJX Companies, in one of the largest reported identity-theft incidents on record.

The United States Attorney in Boston said those charged were involved in the theft of more than 40 million credit and debit card numbers.

TJX, of Framingham, Mass., which owns the Marshall’s and TJ Maxx chains, was the hardest hit by the ring, acknowledging in March 2007 that information from 45.7 million credit cards was stolen from its computers.

The charges focus on three people from the United States, three from the Ukraine, two from China, one from Estonia and one from Belarus.

The authorities said that the scheme was spearheaded by a Miami man named Albert Gonzalez, who hacked into the computer systems of retailers including TJX, BJ’s Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW Inc. The numbers were then stored on computer servers in the United States and Eastern Europe.

They then sold the information to people in the United States and Europe, who used it to withdraw tens of thousands of dollars at a time from automated teller machines, the authorities said.

“This case clearly shows how strokes on a keyboard with a criminal purpose can have costly results,” Michael Sullivan, the United States attorney in Boston, said in a statement. “Consumers, companies and governments from around the world must further develop ways to protect our sensitive personal and business information.”

Mr. Gonzalez, who is being held by New York authorities on another hacking-related charge, was charged with computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, the authorities said.

TJX has agreed to pay more than $60 million to credit-card networks Visa and MasterCard to settle complaints related to the incident, which is one of the largest on record based on the number of accounts involved.