Jeremy writes:

Just got a replacement card from Citi due to possible “compromise of information” but when I asked customer service who the merchant was who may have been compromised, she said she did not have that information, but that it came straight from Visa and Mastercard and that it happened in the last 6-8 months.

Trevor writes:

I logged onto my CitiCard professional account today and discovered an "important security messsage" that my account may be at risk due to a problem with a merchant's database. The CSR said someone had "hacked in" to a database. His manager said she didn't know which merchant was involved, and invoked the TJ Maxx case as an example. When I asked if this was of comparable size, she said it was, and the CitiBank was issuing new cards to people, and that mine should be in the mail already.

Update 09/19/08: We received another report this morning:

Just yesterday, I received a replacement card.

Logging onto their site, I got a message saying my card had been compromised. I decided to activate the new card, but pressed 5 for a consumer rep. This was not the ordinary rep with noise in the background. She had no "sell-up" scripts nor an ebullient demeanor.

She said my card had to be replaced due to a database compromise.

This is a post in our Worst Company In America 2008 series. The companies nominated for this honor were chosen by you, the readers. Keep track of all the goings on at consumerist.com/tag/worst-company-in-america/

STILL OPEN FOR VOTING: Mattel vs ATT, Capital One vs Video Professor, eBay/Paypal vs COX, Apple vs SallieMae, Diebold Vs Pfizer, MTV vs TransUnion
CompUSA vs DirecTV
Target vs Best Buy
Allstate vs Verizon,
DeBeers vs 1800 flowers, Starbucks vs United Airlines,
Exxon vs Crocs, Google Vs Sony, Ticketmaster vs Wachovia, Facebook vs The American Arbitration Association, Comcast vs Menu Foods

"Slips of paper containing people's financial information should not be floating around," says J. Mark Moore, a lawyer at Spiro Moss Barness LLP in Los Angeles.

Among the targets are Rite Aid, Wendy's, FedEx, TJMaxx and IKEA.

Keep an eye on those receipts. Find one with more than 5 credit card digits on it and it could the equivalent of an unclaimed winning lottery ticket, if one were so inclined. — BEN POPKEN

Retailers Whose Slips Show Too Much Attract Lawsuits [WSJ via Consumer World Blog]
(Photo: Mikey aka DaSkinnyBlackMan)

The worm operated undetected for at least 18 months, capturing credit card numbers, then changing timelogs and moving data around to erase its tracks.

Initial speculation suggested that the thieves had access to the retailer's encryption key. Now it may be that the program captured data before it was encrypted.

If the latter, the ramifications are immense, as it means every single retailer's credit card processing system is at risk. — BEN POPKEN

TJX Intruder Had Retailer's Encryption Key [eWeek] (Thanks to Brandon!)

...Making it the largest robbery in the history of man.

It's time to start pressuring merchants to stop endlessly archiving our banking data. Why do they get to keep a copy of our credit cards forever? — BEN POPKEN

TJX breach involved 45.7m cards, company reports [Boston.com] (Thanks to KevinQ!)
(Photo: Sonny-)

From the AP:

"Losses experienced by Wal-Mart and the banks issuing the credit cards currently total more than $8 million in Florida and are still being calculated," a release from the department said.

Framingham, Mass.-based TJX discovered in mid-December that customer data had been stolen by computer hackers and used to make fraudulent debit card and credit card purchases, but did not inform the public of the breach until mid-January. TJX, parent of T.J. Maxx, Marshalls, HomeGoods and other chains, later said it took a month to make the breach public because it was trying to prevent further damage.

The company at first thought the intrusion began in May 2006 and ran into January, but later said it found the breach started nearly a year earlier, in July 2005.

Florida arrests linked to data theft from TJX systems [Boston Globe]
Stolen Data From T.J. Maxx Parent Company Surfaces In Florida Wal-Mart Fraud [Information Week]

PREVIOUSLY: TJ Maxx Security Breach Happened A Year Earlier Than Previously Reported
T.J. Maxx Credit Card Breach Probed By MA & RI AGs
(Photo: Jels)

"TJX Cos. said today that the unauthorized intrusion into its computer system occurred nearly a year earlier than it previously believed.

The Framingham operator of such offprice retail chains as T.J. Maxx and Marshalls offered additional details about a data breach it first disclosed last month.

TJX said today in a statement: "While the company previously believed that the intrusion took place only from May 2006 to January 2007, TJX now believes its computer systems was also intruded upon in July 2005 and on various subsequent dates in 2005. TJX continues to believe there was no compromise of customer data after-mid December 2006."

At this point it might be best to assume that your credit/debit card information has been stolen if you've ever shopped at TJ Maxx/Marshalls. They don't seem to have any idea what is going on. TJ Maxx has a toll-free line at 866-484-6978 for customers with questions about the situation.—MEGHANN MARCO

TJX: security breach happened earlier [Boston Globe] (Thanks, Kalun!)

PREVIOUSLY:TJ Maxx and Marshall's Hacked

Pier 1 Imports Inc. said on Tuesday it had received a temporary restraining order that would prevent TJX Cos. Inc. from filing a lawsuit against Pier 1's new President and Chief Executive Alex Smith....
On Monday, a Pier 1 spokesman said in a statement the company was trying to stop TJX from interfering with Smith's new employment agreement. Such threats were "improper," said spokesman Tom Thomas, because the two companies are not competitors.

The restraining order was necessary "to assure that Alex will be at his post next Monday to oversee the beginning of Pier 1's return to profitability," said Thomas.

Unfortunately, TJ Maxx didn't return calls for comment. They were too busy painting over Smith's parking spot and ripping up old prom photos. Happy Valentine's Day.—MEGHANN MARCO

UPDATE 1-Pier 1 says gets restraining order against TJX [Reuters]

Holiday gift returns: Still nothing easy about it [Money] (Thanks to Octavia!)