In what has been described as the world's biggest theft of credit card details, TK Maxx's US-based parent company TJX said its systems had been breached over an 18-month period from July 2005 until its discovery in December 2006.
The details were stolen from its UK offices in Watford and from other offices in the US, Puerto Rico and Canada, causing worries for customers in Britain and North America. The details are of credit and debit card transactions reaching as far back as December 2002.
TJX owns 2,500 shops around the world, including 210 TK Maxx shops in the UK. Its US and Puerto Rico shop brands are TJ Maxx, Marshalls and HomeGoods and in Canada it owns the Winners and HomeSense chains.
The company has set up a helpline and information section on its for UK customers and advised them to monitor their cards for suspicious transactions.
TJX still does not know the true scale of the theft and has said the 45m number could go higher. It has provided the Metropolitan Police, Visa Europe and the Information Commissioner's Office with intelligence on the theft. It believes the hackers had access to the decryption tool for the encryption software it used.
Customers may not be as badly hit as they fear, according to a spokeswoman the Association of Payment Clearing Services, who said they would generally have been issued with new cards since the transactions affected and if they had become victims of fraud they would be able to get their money back from their banks.
In addition, TJX said at least three quarters of the affected cards had expired or some data on them had been masked.