TJX breach snares over 200,000 cards in region

Community banks in New England have identified at least 200,000 credit and debit cards compromised by the TJX Cos. security breach, and several Massachusetts banks reported cases of fraud connected with card numbers stolen from the Framingham merchant's computer system.

The number of compromised accounts is expected to soar as more banks respond to state surveys, which have not included major financial institutions such as Bank of America, according to Steve Kenneally of America's Community Bankers, a Washington, D.C., trade group.

TJX, which operates T.J. Maxx, Marshalls, and other stores, disclosed a week ago that a hacker stole credit and debit card numbers and driver's license numbers from its computer system in what could be one of the biggest losses of data.

Banks continued to receive new batches of compromised card numbers yesterday, and community banks in New England are estimating that between 15 and 30 percent of their cardholder accounts were affected by the security breach.

Sherry Lang , a TJX spokeswoman, declined to comment on the association's report on fraudulent use of credit and debit cards. The company has received a limited number of cases of potential fraud that need to be followed up, Lang said, and TJX is considering offering free credit monitoring to customers whose cards have been exposed.

The Massachusetts Bankers Association said yesterday that several banks reported fraud linked to debit and credit card numbers pilfered from TJX's computer system for unauthorized purchases made in Florida, Georgia, and Louisiana in the United States, and Hong Kong and Sweden overseas.

Middlesex Savings Bank is reissuing at least 20,000 Visa debit cards and had about a dozen suspected cases of fraudulent activity as far away as California and Japan, bank officials said. The bank said it costs at least $5 to replace a card, and many of the fraudulent charges were occurring at gas stations, discounters, grocery stores, and Internet merchants.

"It's confusing. It's inconvenient. It's scary," said James Lavoie , Middlesex's chief executive and chairman of the Massachusetts Bankers Association. "We found out about this later than we would have liked. I'm not sure why TJX held off."

In a statement released last week, TJX said it learned in mid-December it had "suffered an unauthorized intrusion" into parts of its computers that process and store details of customer purchases. The breach affected data as far back as 2003 and involved the portion of its network that handles credit card, debit card, check, and merchandise return transactions at various stores in the United States and Canada, and potentially locations in Britain and Ireland. The unknown hacker also stole driver 's license numbers and customer names.

The company initially said it delayed reporting at the request of law enforcement, but has since added that it was also a business decision. Banks and customers have criticized TJX for not publicizing the breach more quickly, and some consumers are accusing the company of holding off because it didn't want to scare shoppers in the middle of the busy holiday season. Law enforcement officials have declined comment on the case.

"I think they were holding off because they didn't want to lose money during the holiday season," said Susan Stone of Malden, who said she received a notice last week from Wainwright Bank that her debit card was being canceled because it was compromised. Stone said she shops often at TJX stores but hasn't been back since the reports of data theft.

Wainwright Bank said at least 2,700 cards were reported compromised, but it had no cases of fraud, according to Steven F. Young , a bank senior vice president.

Marcie B. Abainou of Revere said Citibank informed her about fraudulent activity, including multiple $100 charges at gas stations in Florida, that she suspects is connected to the TJX security breach.

"I am grateful my credit card company called me as soon as they noticed the inappropriate activity, but I'm disappointed I have not heard directly from TJX, and I am equally disappointed in the way they are handling this matter," Abainou said.

Banks continued to express frustration with TJX yesterday, raising concerns about the rising costs of the security breach and a shortage of cards to reissue to customers. Some have already begun discussing taking action against the retailer.

"We are actively exploring options to hold TJX liable for any fraud losses that may result from their breach, and hopefully for the cost to our members of repairing the damage they have done," said Jerry Little , president of the New Hampshire Bankers Association.

Jenn Abelson can be reached at abelson@globe.com.