T.J. Maxx owner: 46M card numbers stolen

NEW YORK (CNNMoney.com) -- The retailer that owns the T.J. Maxx and Marshall's clothing chains said nearly 46 million customer card numbers were stolen from its computers over an 18-month period and said the total number of stolen cards may never be known.

TJX (Charts), which also operates other store chains in North America and the U.K., also said 455,000 customers who returned merchandise without receipts had their personal data stolen, including driver's license numbers. The retailer made the disclosures in an SEC filing late Wednesday.

TJX is being sued by affected cardholders in the U.S., Canada and Puerto Rico.

Spokeswoman Sherry Lang told CNN that 45.7 million card numbers had been stolen but noted that 75 percent of those cards were either expired or had their data masked.

The number could increase as more information comes to light, the company said in the filing.

The Framingham, Mass.-based retailer noted that it learned of suspicious software on its computers on December 18, 2006, and soon after contacted General Dynamics (Charts) and IBM (Charts) to assist in the investigation.

"Based on our investigation to date, we believe that our computer systems were first accessed by an unauthorized intruder in July 2005, on subsequent dates in 2005 and from mid-May 2006 to mid-January 2007, but that no customer data were stolen after Dec. 18, 2006," the company said in the filing.

TJX believes information stolen in September and November 2005 involved at least half and could have affected all the transactions at U.S., Puerto Rican and Canadian stores from Dec. 31, 2002 through June 28, 2004.

TJX says its investigation is ongoing.

"We are continuing to try to identify information stolen in the computer intrusion through our investigation, but ... we believe that we may never be able to identify much of the information believed stolen," the filing said.

-----------------------------------------------------------

Stolen T.J. Maxx numbers being used