On 17 January 2007, TJX Companies — the Framingham, Massachusetts parent of T.J. Maxx, Marshalls, HomeGoods and Winners — issued a short press release confirming "an unauthorized intrusion" into the computer systems that processed its payment card transactions. The language was careful. The scale was not disclosed. The share price barely moved. Ten weeks later, in a filing with the US Securities and Exchange Commission, TJX put a number on it: at least 45.6 million credit and debit card numbers taken from its systems over a period of more than eighteen months. It was, at that point, the largest card compromise ever recorded. The company also disclosed what it had spent on the incident so far: roughly $5 million. That pairing — the biggest breach in history and a five-million-dollar line item — is the most useful artifact in data breach history for understanding what pre-GDPR security actually meant. Not that companies didn't care. That the consequences were survivable, and everyone knew it.
Eighteen Months Inside, Ten Weeks of Silence
The timeline matters more than the headline number. Intruders had access to TJX systems from mid-2005. The company detected suspicious software in mid-December 2006, confirmed the intrusion within days, and notified law enforcement — which asked for a delay in public disclosure while the investigation proceeded. Customers learned on 17 January 2007. The full scope arrived with the SEC filing at the end of March. By any modern standard, each of those intervals would now be a regulatory event in its own right. In 2007, they were simply how incident response worked.
What Actually Failed
The post-mortems conducted by US state attorneys general and by Canadian privacy regulators describe a set of failures that would be unremarkable in a mid-market environment today:
- Weak wireless encryption. Store networks relied on WEP, a protocol already known to be breakable with commodity tooling, long after stronger options existed.
- A flat network. Once inside the store environment, attackers could reach systems that processed and stored card data centrally.
- Data retained that should never have been kept. Full magnetic-stripe track data and historic transaction records sat on systems with no business need for them.
- No meaningful detection. Eighteen months of exfiltration passed without an alert that anyone acted on. Canadian and Alberta privacy commissioners reached the same conclusion in their joint 2007 findings: TJX collected more personal information than it needed, kept it too long, and protected it with encryption it should have retired years earlier. The interesting part is that none of this required sophistication from the attacker. It required patience.
The 2007 Price of Losing 45 Million Cards
Here is where the era shows itself. TJX's costs accumulated over several years and across several forums:
- Roughly $5 million disclosed as of March 2007, later expanded to reserves reported in the hundreds of millions once litigation, card-brand assessments and remediation were included.
- A $9.75 million multi-state settlement with 41 attorneys general in 2009, which also required TJX to implement and maintain a comprehensive information security program.
- Settlement funds negotiated with Visa and MasterCard to compensate issuing banks for card reissuance.
- An FTC consent order requiring two decades of biennial independent security assessments — and carrying no fine at all. Meanwhile, TJX kept growing. Revenue rose. The stock recovered. No executive lost a job over it in any way the public could observe. The breach was expensive, but it was a cost of doing business, not an existential threat.
Why the Consequences Were So Light
There was no legal machinery in 2007 capable of producing a different outcome. In the United States, breach notification existed only as a patchwork of state statutes descending from California's SB 1386, which took effect in 2003. There was no federal breach law, no regulator with authority to fine a retailer a percentage of turnover, and no securities disclosure rule specific to cyber incidents. In Europe, the governing instrument was Directive 95/46/EC, which imposed data protection principles but contained no breach notification duty and left enforcement to national authorities with modest penalty powers. The GDPR would not be adopted until 2016, or apply until May 2018. Payment security itself was governed contractually rather than legally. PCI DSS obligations flowed from card-brand agreements, enforced through fines levied on acquiring banks and passed down to merchants. In that environment, the rational corporate posture was to spend on security proportionate to the expected cost of a breach. In 2007, that expected cost was low.
What Changed Between 2007 and Now
Almost everything about the downside.
- GDPR requires notification to a supervisory authority within 72 hours of becoming aware of a personal data breach, and allows fines up to €20 million or 4% of global annual turnover.
- US securities rules adopted in 2023 require public companies to report material cybersecurity incidents on Form 8-K within four business days of determining materiality.
- The UAE's Federal Decree-Law No. 45 of 2021 established a national personal data protection framework, alongside separate regimes in the DIFC and ADGM.
- DORA imposes incident reporting and resilience testing obligations on EU financial entities and their critical ICT providers, with application from January 2025.
- PCI DSS 4.0.1 made a substantial set of previously future-dated requirements mandatory from 31 March 2025. Layered on top: class action litigation, cyber insurance underwriting that now verifies control attestations, and enterprise procurement processes that ask for evidence before signing. The TJX breach in 2026 would not be a $5 million disclosure. It would be a regulatory filing, a multi-jurisdiction notification exercise, an insurance dispute, and a sales problem.
The 2026 Version of the Same Mistake
The failures that produced this breach have not disappeared; they have changed address. Unneeded data retention is now a SaaS and data-warehouse problem rather than a store-server problem. Flat networks have become over-permissioned cloud identity. The unmonitored store Wi-Fi of 2007 is the unowned integration, the legacy VPN appliance, or the contractor account nobody revoked. Detection has improved industry-wide — median attacker dwell time is now measured in days rather than months — but that average conceals a long tail of organizations with no detection capability at all. The practical question for a mid-market operator has not changed since 2007: what data are you holding that you could delete, who can reach it, and would you know if someone did?
| Historical issue in the article | Modern review question |
|---|---|
| Obsolete wireless protection | Which legacy access path or appliance has no current owner? |
| Flat network access | Which cloud identities can reach more data than their job needs? |
| Unneeded records retained | Which SaaS, archive or warehouse records can be deleted? |
| Unacted-on detection | Who owns alerts and can establish whether records were accessed? |
Qualitative summary of this article's source text, not a measured outcome or performance estimate.
Common Questions
How many records were exposed in the TJX breach?
TJX disclosed at least 45.6 million card numbers in its March 2007 SEC filing, covering a period of more than 18 months. Later court filings and forensic estimates pushed the figure considerably higher, with some analyses citing more than 90 million cards.
Would the TJX breach be handled differently under GDPR?
Substantially. GDPR would require notification within 72 hours of awareness, individual notification where risk to data subjects is high, and would expose the company to fines calculated against global turnover rather than negotiated settlements with state regulators.
Was TJX PCI compliant at the time?
No. Regulator post-mortems identified retention of prohibited card data and inadequate encryption — both direct PCI DSS violations. That said, being assessed as compliant is not the same as being secure, as later breaches at certified merchants demonstrated.
What should a mid-market company take from a 2007 retail breach?
Three things: delete data you have no business reason to keep, segment the environments that touch payment or personal data, and make sure someone is actually reading the alerts. None of those are products.
Free Security Audit — Outpace reviews mid-market environments the way regulators and insurers now do: what data you hold, who can reach it, and what evidence you could produce if you had to notify within 72 hours. If that would be difficult today, it is worth an hour of our time.