For anyone who thought that 45 million was an absurdly high number of payment cards to be compromised in a data breach, try 94 million. That"s the total number of cards actually exposed in the breach disclosed by TJX Companies Inc. earlier this year, according to court documents filed yesterday by a group of banks suing the Framingham, Mass.-based retailer over the incident. The filings, made in federal court in Boston, relate to a dispute over whether the multiple financial institutions who are plaintiffs in the case should be treated as a class or whether each bank would be required to pursue individual cases against TJX. The plaintiffs in the case include the Massachusetts Bankers Association, the Connecticut Bankers Association, the Maine Association of Community Banks and AmeriFirst Bank Inc.
In documents arguing for class action status, the banks claim that the TJX breach affected 94 million separate card holder accounts over a 17-month period -- not 45.6 million accounts, as TJX had disclosed. Quoting figures supplied by the card companies themselves, the bankers said that the breach affected approximately 65 million Visa account numbers and an additional 29 million MasterCard accounts. To date, the losses by card-issuing companies on Visa accounts alone total between $68 million and $83 million, the banks said, citing the Visa information.