TJX customers who lost a whopping 45.2 million credit or debit card numbers will not be offered credit monitoring in the tentative settlement TJX drafted in hopes of smoothing over its data breach controversy.

TJX is offering three years of credit monitoring and identity theft insurance, but only to 455,000 customers who returned merchandise to TJX stores without receipts. The entire breach affected 45.7 million card numbers, the owners of which will be offered vouchers that can be used at TJX stores.

TJX’s proposed settlement reads as follows: “TJX will make available to the approximately 455,000 customers who returned merchandise to a TJX store without receipts and who were sent letters from TJX stating that TJX had specifically identified that their names, addresses and drivers’ license or military, state or tax identification numbers were believed to have been stolen in the Intrusion (“Unreceipted Return Customers”) three years of credit monitoring and identity theft insurance.”

TJX goes on to say that “unreceipted return customers” who accepted a previous offer from TJX will receive only two years of monitoring and insurance. TJX will also reimburse the 455,000 customers without receipts for the cost of replacement drivers' licenses and for financial losses related to identity theft.

Even the offer of credit monitoring is a weak response to the data breach, claims Pat Dane, co-founder of MyPublicInfo, which is offering two months of free fraud detection services to TJX breach victims.

“Credit monitoring is only good after the fact, after someone has already stolen your information and identity,” Dane says.

TJX is also offering $30 store vouchers to customers who lost time or money due to the theft of card data, and will hold a three-day sale for all customers in which all prices will be reduced by 15% for three consecutive days.

A court ruling on the settlement could be issued by the spring, The Boston Globe reported. The story also notes that TJX says 75% of the compromised cards were expired or had data in the magnetic strip masked.

MyPublicInfo is offering two months of free IdentitySweep services to customers who say they were affected by the TJX breach and log on to this Web site.

The service typically costs $9.95 per month, and compares subscribers’ credit card numbers to those that have been stolen or that are being sold on the Web. “We have software robots and human beings that monitor hacker chat rooms 24/7 and look for stolen credit cards and stolen debit cards,” Dane says.

Whitepapers

• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users
• IT Departments on Data Security: A Research Concepts Survey

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports