Full list of TK Maxx stores in Britain

The world’s biggest theft of credit card details has left 45 million customers exposed to fraud.

Everyone who paid with credit or debit cards at any branch of TK Maxx between January 2003 and June 2004 is at risk.

Customers of the fashion chain’s 210 stores in Britain have already had their card details used to make fraudulent transactions.

The company admitted that details of credit and debit cards used in its shops had been stolen by sophisticated computer hackers and warned its customers last night to monitor their credit and debit card statements for suspicious transactions.

The company confirmed that information had been stolen from 45.6 million cards used in Britain and North America between December 31, 2002, and November 23, 2003. It did not know how many had been stolen for transactions made between November 24, 2003 and June 28, 2004.

Sherry Lang, a spokeswoman for the American company TJX, which owns TK Maxx, told The Times: “These figures only relate to what we do know. There is a lot more we do not know and may never know. We have identified two [computer] files that were removed from our UK system but we still do not know precisely what was in them.” The company said that it did not know which customers’ details had been stolen, but that banks had indicated that they had “preliminary evidence of possible fraudulent misuse” of the card details.

A spokesman for Visa Europe said: “All the major card brands accepted by the retailer are affected and Visa USA is working with law enforcement and TJX to investigate.”

The theft of customer records held on computers at the company’s British headquarters in Wat-ford, Hertfordshire, and in the United States, Puerto Rico and Canada, is the biggest theft of credit card information in the world.

TJX, which owns 2,500 shops across the world, admitted yesterday that its computer system had first been breached in July 2005 and continued unnoticed for 18 months. The company discovered the breach on December 18 last year but only made full details available yesterday.

Police believe that the hackers have been selling the credit card details on to other criminals to make fraudulent transactions. The Metropolitan Police, the Information Commissioner’s Office and Visa Europe have received intelligence on the theft, the company said.

A spokeswoman for the Information Commissioner’s Office, said: “The Information Commissioner’s Office takes such breaches of privacy extremely seriously. The breach also involves the company’s operations in Canada and we have been in contact with the Canadian privacy commissioner, who is investigating the matter. To date we have received no complaints on this subject.”

The theft comes after a warning from Richard Thomas, the Information Commissioner, that it was “vital that banks and other organisations take security seriously”. This month 12 British banks were named and shamed after they dumped customers’ personal details in outdoor rubbish bins.

TJX is already facing an investigation by the Federal Trade Commission in the United States and lawsuits from individuals and banks accusing it of doing too little to safeguard private data and of delaying disclosure of the problem. The company said that even where credit card details had been kept securely they may still have been stolen because the hackers accessed its encryption software and could have known how to unscramble the information.

In addition, TJX deleted much of the transaction data in the normal course of business between the time of the thefts and the time they were detected, making it impossible to know how many cards were affected. Carol Meyrowitz, TJX president and chief executive, said: “I want our customers to know how much I personally regret any difficulties you may experience as a result of the unauthorised intrusion.”

Despite the huge scale of the fraud, it emerged last night that victims of credit card scams are to be sent to the banks to complain, rather than the police.

Legislation changes, hidden in the small print of the 2006 Fraud Act, make banks responsible for collating fraud figures on deception involving cheques, plastic cards or online transaction. The banks will be required to pass their findings on to the police, although critics expressed fears financial institutions would be able to manipulate figures to mislead the public about the severity of the issue.

— T K Maxx has set up customer helplines. British customers can call 0800 779015 and those in the Republic of Ireland, 0044 800 779015.

— The homepage at www.tkmaxx.com has an “important customer alert” explaining how to contact credit card issuers