Retailer's data breach wider than believed

WASHINGTON — Retail giant TJX, whose stores include discount clothing chains T.J. Maxx and Marshalls, said Wednesday a computer-security breach stretched back 10 months earlier than it had originally thought, compromising credit- and debit-card data, driver's license numbers, and names and addresses.

The announcement underscores a trend of breaches involving sensitive credit-card data and reflects failures to properly secure computer systems, to notify customers when breaches occur and to update laws for the cybercrime age, lawmakers and analysts said.

T.J. Maxx and Marshalls each have seven locations in the Seattle-Tacoma metropolitan area.

TJX said that while it first thought the intrusion took place from May 2006 to January 2007, it now thinks its computer system was also hacked in July 2005 and on "various subsequent dates" in that year.

The company first reported the intrusion in January, a month after it said it discovered the breach.

It has refused to say how many customers may have been affected and how many have been notified.

"We don't have a number for you there. Our work is not finished," spokeswoman Sherry Lang said Wednesday.

More than 50 computer experts are helping investigate the breaches, she said.

Banks that issued the credit cards have not said how much they have had to cover in fraud-related losses.

More than 30 states, including Washington, have laws that require companies to notify customers as soon as possible when a breach has occurred, although most of the statutes allow companies to delay notification while law-enforcement agencies investigate.

A bipartisan group of senators had reintroduced legislation that would mandate customer notification and require companies that maintain personal information to establish internal policies to protect it.

"Americans live in a world where their most sensitive personal information can be accessed and sold to the highest bidder, with just a few keystrokes on a computer, yet our privacy laws haven't kept pace," Sen. Patrick Leahy, D-Vt., said in a written statement when the legislation was reintroduced this month.

The credit-card industry has set up rules for data protection called the Payment Card Industry Data Security Standard.

They include encrypting transmission of cardholder data, regularly testing security systems and processes, and restricting access to data to those with a "need to know."

But most large retailers have not complied with the standard, and noncompliance is about 80 percent among smaller retailers, said Avivah Litan, an analyst with Gartner, an information-technology research firm.