The TJX Breach of 2007: How Weak Wi-Fi Encryption Cost Millions
In 2007 retailer TJX disclosed one of the largest card thefts of its time. Here is how the thieves got in, and what website owners should take from it today.
In January 2007, The TJX Companies, the owner of T.J. Maxx, Marshalls and other retail chains, announced that its computer systems had been broken into. It turned out to be one of the largest thefts of payment card data the world had seen up to that point. The story is a useful reminder that big breaches rarely start with something exotic. They start with ordinary weaknesses that nobody got around to fixing.
What happened
TJX said that an unauthorised intruder had accessed a system that handled customer transactions, and that the intrusion had gone on for a long time before anyone noticed. According to the company's later filings and the investigations that followed, intruders first accessed its systems in July 2005 and returned at various times until mid-January 2007, although the company said no customer data was stolen after December 2006. The data involved included payment card numbers and, for some customers, driver's licence and other identification details collected when processing returns without a receipt.
The figures reported at the time ran from tens of millions of card numbers upwards, and the total was revised more than once as investigations continued. What is not disputed is the scale: it was the largest retail card breach disclosed in 2007, and it triggered lawsuits from banks, card issuers and customers.
How the attackers got in
Investigators and later court documents pointed to weak wireless security at store locations. Several stores were reported to be using WEP, an early Wi-Fi encryption standard whose flaws had been publicly documented for years. Once attackers were inside a store network, they were able to move into central systems and set up tools to capture card data as it passed through.
Two further problems made the damage worse:
- Data was kept longer than it needed to be. Old transaction data was stored on systems where it had no business sitting.
- The intrusion went unnoticed for a long time. Nobody was watching for unusual data movements out of the network.
The people behind it
In August 2008, US prosecutors charged a group that included Albert Gonzalez over the attacks on TJX and several other retailers, and in 2009 he was also charged over the breaches at Heartland Payment Systems and Hannaford. Gonzalez pleaded guilty and in 2010 was sentenced to 20 years in prison, one of the longest sentences handed down for a computer crime at that time. The case showed that card theft had become an organised, profitable business rather than a hobby.
The consequences
TJX settled with card networks, issuers and consumer groups, and set aside substantial sums to cover the cost. The breach also helped push the payments industry towards stricter rules. The PCI Data Security Standard, which already existed, began to be enforced much more seriously, and requirements on wireless encryption and on storing card data became a bigger part of audits. WEP was effectively retired in favour of WPA and later WPA2.
Old weaknesses, new names
The same four patterns show up on websites every day:
| Weakness at TJX | Equivalent for a website |
|---|---|
| Outdated Wi-Fi encryption | Old TLS versions, outdated PHP or CMS versions, unmaintained plugins |
| Flat internal network | One account or one site able to reach everything on the server |
| Data stored for too long | Old customer exports, backups and form submissions left in public folders |
| Months without detection | No log review, no alerts on file changes or logins |
None of these problems is hard to understand. They persist because they are boring: nobody gets thanked for retiring an old protocol or deleting a database export. Breaches tend to find exactly those neglected corners.
Stop collecting what you cannot protect
The most reliable way to avoid leaking data is to not hold it. If you run an online shop, let a specialised payment provider handle card details so they never touch your own server. Review which personal data your forms actually need, and delete old exports, test databases and forgotten backups that sit in web-accessible folders.
A timeline of what went wrong
Looking at the sequence makes the failure easier to see. The intrusion began in 2005, long before most people had heard of the company's problems. For roughly a year and a half the attackers were able to collect data without being detected. TJX only announced the breach in January 2007, after it had been alerted to suspicious activity, and cooperation with law enforcement meant that public disclosure was delayed while an investigation was under way.
Later, regulators and courts examined whether the company had met the card industry's own security rules. Canadian privacy commissioners published a joint report in 2007 that criticised TJX for collecting more customer information than it needed and for keeping it too long, in addition to the technical shortcomings. That finding is worth remembering: the investigators judged the data retention policy to be part of the failure, not just the weak encryption.
The practical lesson for site owners
Treat every outdated component as a door left unlocked: update software, remove what you no longer use, keep sensitive data to a minimum and make sure someone is looking at logs. Encrypt traffic to your site with a valid certificate, which is free with our SSL certificates, and read our security overview to see how hosting plans can support a cleaner, better-monitored setup.
If your site collects customer details, ask once a quarter: what do we store, why, and who can reach it? The answer is usually shorter than you expect, and that is a good outcome.
