Ukrainian May Have Ties to TJX Theft

A Ukrainian man recently arrested in Turkey is suspected of selling some of the credit and debit card numbers stolen in a data hack of at least 45 million cards of TJX Cos. retail customers, a U.S. investigator said Tuesday.

TJX is the owner of 2,500 discount retail stores worldwide including T.J. Maxx and Marshalls.

Authorities hope the arrest of Maksym Yastremskiy, suspected of being a major international trafficker in stolen data, will eventually lead to information uncovering the TJX intruders' identities.

"He was involved in the distribution of information," Greg Crabb, an agent with the U.S. Postal Inspection Service's global investigations unit, told The Associated Press. "We do have information that suggests other individuals were the masterminds of the hack."

U.S. investigators' interest in Yastremskiy in connection with the TJX case was first reported Tuesday in The Boston Globe. The 24-year-old was arrested weeks ago in the Turkish resort city of Kemer.

Yastremskiy's capture follows the arrests in Florida of 10 people accused of using stolen TJX customer data to buy Wal-Mart gift cards, though they also aren't believed to be the TJX hackers. Several have entered guilty pleas in recent months.

Crabb said information from Turkish officials holding Yastremskiy indicates he was a major trafficker in stolen data from sources including TJX.

"At one particular instance, he had solicited the sale of over a million credit card numbers," Crabb said. "To be able to gain access to that much data, you've got to have a good source."

Crabb said information from credit card issuers pointed to Yastremskiy as the source of illegally trafficked data stolen in the TJX case. Card numbers were allegedly trafficked online and internationally, as is common in identity theft cases that frequently stretch across the globe and often involve Eastern Europe.

TJX disclosed the breach on Jan. 17, and said March 28 that one or more intruders unearthed data from at least 45.7 million credit and debit cards from transactions as long ago as early 2003.

Independent organizations that track data thefts say the TJX case is believed to be the largest in the United States based on the number of customer records compromised.

TJX says about three-quarters of the 45.7 million cards had either expired by the time of the theft, or the stolen information didn't include security code data from the cards' magnetic stripes. However, TJX also has said the intruders could have tapped the unencrypted flow of information to card issuers as customers checked out with their credit cards.

Officials from the U.S. Secret Service and Department of Justice, which also are investigating the TJX case, declined to comment Tuesday, as did a spokeswoman for Framingham, Mass.-based TJX.


  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

  • Qualcomm Back in Datacenter Fray with AI Chip

    The chip maker joins a crowded field of vendors that are designing silicon for processing AI inference workloads in the datacenter.

  • Microsoft To Ship Surface Hub 2S Conference Device in June

    Microsoft on Wednesday announced a June U.S. ship date for one of its Surface Hub 2S conferencing room products, plus a couple of other product milestones.

  • Kaspersky Lab Nabs Another Windows Zero-Day

    Kaspersky Lab this week described more about a zero-day Windows vulnerability (CVE-2019-0859) that its researchers recently discovered, and how PowerShell was used by the exploit.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.