Retail & Fintech · Retail · Regulatory action + Private litigation

TJX (TJ Maxx/Marshalls/HomeGoods)

Attackers broke into TJX in July 2005 by cracking the WEP encryption on the Wi-Fi at a Miami-area Marshalls, then moved to the central payment servers and sat there undetected for roughly a year and a half - TJX only noticed in December 2006. At least 45.7 million cards, with some estimates as high as 94 million. Canada's Privacy Commissioner concluded TJX had collected too much information, kept it too long, and relied on weak encryption to protect it, and card-industry plaintiffs alleged the company failed to follow 9 of the 12 PCI DSS requirements. TJX set aside $107 million in 2007 alone for the fallout (by August 2007 the total cost was reported at at least $256 million, per the Boston Globe as reported by the ABA Journal), and settlements included roughly $41 million to Visa's issuers, up to $24 million to MasterCard's, $9.75 million to 41 state attorneys general. The FTC settlement carried no fine at all - the FTC lacked authority to levy civil penalties under the FTC Act - only a mandated security programme and biennial audits for twenty years.

Severity
Evidence tierUnassigned
Claims confirmed
Last verified2026-08-04

Primary source. www.ftc.gov/legal-library/browse/cases-proceedings/072-3055-tjx-companies-inc-matter — Verified - primary source confirmed.

Freshness. Last verified 96 days ago (2026-08-04); stale after 180 days.

Terms

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

ONE OF THE LARGEST, MOST HISTORICALLY SIGNIFICANT DATA BREACHES EVER RECORDED (2007): the TJX Companies breach (encompassing TJ Maxx, Marshalls, HomeGoods, and other TJX brands) exposed AT LEAST 46 MILLION consumer records — at the time, the LARGEST data breach ever publicly disclosed, surpassing the previous record (CardSystems, 40 million, 2005). Attackers exploited a VULNERABLE WIRELESS NETWORK starting July 2005, operating UNDETECTED for approximately 18 MONTHS before TJX discovered the intrusion in December 2006 (publicly disclosed January 2007). The attack was orchestrated by ALBERT GONZALEZ, a notorious hacker who was SIMULTANEOUSLY a secret informant for the US Secret Service — a genuinely remarkable detail, since the person responsible for one of history's largest breaches was, at the same time, working for federal law enforcement. Security experts specifically criticized TJX for failing to PROMPTLY DELETE old customer transaction data and for unclear encryption practices. Multiple banking associations (Massachusetts, Maine, Connecticut) sued TJX directly to recover the costs of reissuing compromised cards.

Fees and billing

NOTABLE PRACTICE (reported; current use not re-verified as of Oct 2026): TJX stores (and many other retailers) have reportedly used a THIRD-PARTY SERVICE called 'THE RETAIL EQUATION' to track and LIMIT customer RETURNS across participating stores — documented customer complaints describe being told they cannot make another return for MONTHS based on a centralized cross-retailer return history the customer has no direct visibility into or control over, with store staff sometimes unable to explain the specific policy or provide transparency into how the tracking works.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (TJX). Service route: c/o General Counsel / Corporate Secretary, Framingham, Massachusetts — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.

Paper trail: none. No published channel.

Evidence

Claim	Kind	Support	Sources
1. Attackers broke into TJX in July 2005.	fact	unsupported	1 (1 confirmed)
2. Attackers cracked the WEP encryption on the Wi-Fi at a Miami-area Marshalls.	fact	unsupported	none recorded
3. Attackers moved to TJX's central payment servers.	fact	unsupported	none recorded
4. Attackers sat undetected for roughly a year and a half; TJX only noticed in December 2006.	fact	unsupported	1 (0 confirmed)
5. At least 45.7 million cards were affected.	fact	unsupported	1 (1 confirmed)
6. Some estimates put affected cards as high as 94 million.	fact	unsupported	1 (1 confirmed)
7. Canada's Privacy Commissioner concluded TJX collected too much, kept it too long and relied on weak encryption.	fact	unsupported	1 (0 confirmed)
8. Investigators found TJX non-compliant with 9 of the 12 PCI DSS requirements.	fact	unsupported	1 (0 confirmed)
9. Total cost exceeded $250 million.	fact	unsupported	1 (0 confirmed)
10. TJX paid roughly $41 million to Visa's issuers.	fact	unsupported	1 (0 confirmed)
11. TJX paid up to $24 million to MasterCard's issuers.	fact	unsupported	1 (0 confirmed)
12. TJX paid $9.75 million to 41 state attorneys general.	fact	unsupported	1 (0 confirmed)
13. TJX entered an FTC settlement.	fact	supported	none recorded
14. The FTC settlement carried no fine.	fact	unsupported	1 (1 confirmed)
15. The FTC lacked authority to levy civil penalties under the FTC Act.	fact	unsupported	1 (0 confirmed)
16. The FTC settlement mandated a security programme and biennial audits for twenty years.	fact	unsupported	1 (1 confirmed)

5 of 16 claims have a confirmed source of their own.

Sources

Source	Claim	Tier	Status	Quote
regulator · 2008-08-01 www.ftc.gov/sites/default/files/documents/cases/2008/08/080801tjxcomplaint.pdf	Claim 1	Unassigned	confirmed	“Between July 2005 and November 2005, an intruder connected to respondent's networks without authorization” Quote basis: not recorded.
court · 2007-10-12	Claim 4	Unassigned	corrected	“TJX did not discover the security breaches until fourteen months later, in December 2006.” Quote basis: not recorded.
court · 2007-10-12	Claim 5	Unassigned	confirmed	“compromised the security of at least 45,700,000 customer credit and debit accounts” Quote basis: not recorded.
court · 2008-11-03	Claim 6	Unassigned	confirmed	“contended the hackers actually compromised the security of over 94,000,000 accounts” Quote basis: not recorded.
none	Claim 7	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 8	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 9	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 10	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 11	Unassigned	not found	No quote recorded. Quote basis: not recorded.
none	Claim 12	Unassigned	not found	No quote recorded. Quote basis: not recorded.
regulator · 2008-07-29 www.ftc.gov/sites/default/files/documents/cases/2008/08/080801tjxdo.pdf	Claim 14	Unassigned	confirmed	No quote recorded. Quote basis: not recorded.
none	Claim 15	Unassigned	not found	No quote recorded. Quote basis: not recorded.
regulator · 2008-07-29 www.ftc.gov/sites/default/files/documents/cases/2008/08/080801tjxdo.pdf	Claim 16	Unassigned	confirmed	“for twenty (20) years after service of the order for the biennial Assessments” Quote basis: not recorded.

Source vault

Link status: Candidate - not yet fetched

Document	Last fetch	PDF
Privacy policy tjmaxx.tjx.com/store/help/privacyPolicy.jsp	Not fetched yet	NO (HTML only)
Terms of service tjmaxx.tjx.com/store/help/tos.jsp	Not fetched yet	NO (HTML only)
Website tjx.com	Not fetched yet	—
Primary source https://www.ftc.gov/legal-library/browse/cases-proceedings/072-3055-tjx-companies-inc-matter Verification: Verified - primary source confirmed	Not fetched yet	—

Enforcement

No enforcement actions are linked to this row.

State statute

No comprehensive state privacy statute on file for Massachusetts