2 Operation Get Rich or Die Tryin': How the TJX Breach Set the Stage for a Decade of Payment Card Conflict

In July 2005, Albert Gonzalez, Damon Patrick Toey, and Christopher Scott started taking “war driving” expeditions along the South Dixie Highway in Miami. Armed with a laptop and a large radio antenna, the three friends, all in their twenties, tested the wireless signals of the businesses they drove past, looking for vulnerable wireless networks that they could connect to and use to intercept potentially valuable packets.
a
They found what they were looking for at a Marshalls clothing store, part of a chain owned by TJX Companies Inc., the same company that owns T.J. Maxx.
1
Connecting to the wireless network of that Marshalls store in Miami set in motion the lengthy and highly profitable data breach that Gonzalez, Toey, Scott, and their co-conspirators carried out against TJX—a data breach that was revealed in 2007 to have resulted in the compromise of 45.7 million payment card numbers belonging to TJX customers as well as the theft of hundreds of millions of dollars. And that breach, as well as others like it, in turn set in motion an extended and bitter battle over who should bear the costs of payment card fraud and who was responsible for preventing it—a fight that did as much to hinder attempts to reduce financial fraud as it did to hasten the arrival of more secure payment card technologies.