TJX Breach More Than Twice As Bad As Had Been Reported

Despite TJX having reported some 46 million consumers impacted, new documents now identify that number as about 96 million, including about 29 million MasterCard victims and 65 million Visa victims, according to documents filed with the federal court on Tuesday.

The new numbers came to light in filing from attorneys representing some of the banks now suing TJX.

"Beginning in July 2005, TJX experienced a massive intrusion into its computer systems, resulting in the largest data security breach in history and the compromise of an unprecedented amount of confidential nonpublic consumer personal data," said the plaintiff filing. "Although TJX suggests that the breach only affected approximately 45.7 million accounts, in fact the breach during a period of 17 months affected more than 94 million separate accounts. To date, Visa has calculated the fraud losses experienced by issuers as a result of the breach to be between $68 million and $83 million on Visa accounts alone."

Plaintiffs based their new numbers on depositions from Visa and MasterCard that had been confidential until Tuesday.

But the testimony of Visa's Joseph Majka describes some 96 million impacted account numbers, with fraud occurring in some 13 different countries.

In dozens of documents filed on Tuesday by both sides in the TJX breach lawsuit involved various banks, little new was learned about the breach beyond the much greater number of impacted consumers.

Most of the documents involved whether the plaintiffs were similar enough to be a class for class-action purposes and whether the banks acted appropriately when some quickly canceled and reissued credit cards.