Banks Allege TJX Under-reported Number Affected by Data Thefts

A group of banks alleged in a court filing ithat 94 million accounts were affected by the theft of personal data from Massachusetts-based TJX Cos. — more than double the number the company previously reported in what already is the largest data breach in history.

The data breach affected about 65 million Visa account numbers and about 29 million MasterCard numbers, according to the court filing made public by a group of banks suing TJX over costs associated with the breach.

The banks cited sealed testimony from Visa and MasterCard officials, The Boston Globe reported this week.

A Visa official estimated there were between $68 million and $83 million in fraud losses on Visa accounts alone at banks and other institutions that issued the cards, the newspaper said.

TJX had previously said the hackers who breached its systems compromised at least 45.7 million credit and debit card numbers as far back as 2003.

The company has said about 75 percent of the compromised cards were expired or had data in the magnetic strip masked, meaning the information was stored as asterisks rather than numbers.

A spokeswoman for Framingham-based TJX, which operates more than 2,500 stores worldwide under such brand names as TJ Maxx and Marshalls, told the Globe she couldn’t immediately discuss the filing. She said the company doesn’t generally discuss pending litigation.

Spokesmen for Visa and MasterCard did not respond to questions from the Globe.

No one has been directly charged with the breach. Six people in Florida were found guilty of using phony credit cards with numbers stolen from TJX to purchase goods illegally.

Last month, Canadian privacy officials faulted TJX for failing to adequately protect customer information. The investigators said TJX believed the intruders gained access to the data through wireless local area networks at two Marshalls stores in Miami. The networks use radio waves to collect and transmit data, such as credit card numbers.

The claims filed by the banks on Tuesday are part of ongoing litigation between TJX and Fifth Third Bancorp of Ohio, the bank that handled its card transactions, as well as a larger group of institutions including the Massachusetts Bankers Association.

TJX has reached a tentative settlement with attorneys representing consumers harmed by the breach.

If the deal is finalized, they would receive benefits including cash or merchandise vouchers and credit. TJX has estimated the price of the deal at around $256 million, but several analysts have estimated the breach could cost TJX $1 billion, including legal settlements and lost sales.