The TJX Companies, Inc. Security Breach – Q&A

Q: Is it true that there was a recent incident involving a data compromise at TJ Maxx/Marshalls/TJX Companies?
A: Yes. The TJX Companies, Inc., which owns T.J. Maxx, Marshalls, HomeGoods, A.J. Wright, and Bob’s Stores in the U.S., experienced a card security breach. Although certain account data may have been exposed in this incident, it does not necessarily mean that data related to your account was taken or that fraud has occurred on your account. Please be assured that Mazuma is actively monitoring the activity on your account to protect you from fraud.

As always, we strongly encourage you to review your monthly statement carefully and call us immediately if you see any suspicious activity. It’s also important to note that in the rare event fraud does occur, as a Visa cardholder you are protected with Visa’s Zero Liability* policy, which means you pay nothing for unauthorized purchases on your account.

Q: Which stores does TJX Companies own?
A: TJX Companies operates eight businesses and more than 2,300 stores around the world. TJX’s store brands include T.J. Maxx, Marshalls, HomeGoods, A.J. Wright and Bob’s Stores in the U.S., Winners and HomeSense in Canada, and T.K. Maxx in Europe.

Q: How did this happen?
A: An intruder hacked into a TJX Companies’ database and potentially gained access to data from accounts across all card brands. Please review your monthly statement carefully and call us immediately if you see any suspicious activity. While fraud resulting from data compromises is rare, it’s important to understand that Mazuma continually monitors your account to prevent fraud from occurring and that you’re protected with Visa’s Zero Liability* policy.

Q: I have shopped at one of TJX Companies’ stores. Can you tell me if my card information was stolen in this incident or if it has been used fraudulently?
A: Although certain card account data may have been exposed in this incident, it does not necessarily mean that data related to your account was taken or that fraud has occurred or will occur on your account. Please be assured that Mazuma is actively monitoring the activity on your account to protect you from fraud.

As always, we strongly encourage you to review your monthly statement carefully and call us immediately if you see any suspicious activity. And remember that in the rare event fraud does occur, as a Visa cardholder you are protected with Visa’s Zero Liability* policy, which means you pay nothing for unauthorized purchases on your account.

Q: How many cards were involved in the incident?
A: We believe the intruder who hacked into TJX Companies’ system may have had access to data from tens of millions of card accounts across all card brands.

Q: Does this incident impact MasterCard, American Express and Discover?
A: Yes. All card brands are impacted.

Q: When did the incident occur?
A: That investigation is still ongoing at this time.

Q: Has the security breach been fixed?
A: TJX Companies is working with law enforcement and all card brands to ensure no further information is exposed.

Q: What part of my information was stolen?
A: It is too early to say if any of your information is actually at risk. It’s important to note that although your information may have been exposed, it does not necessarily mean fraud has occurred on your account. Mazuma is actively monitoring the activity on your account to protect you from fraud. Additionally, as a Visa cardholder you are protected with Visa’s Zero Liability* policy so that in the rare event fraud does occur, you pay nothing for fraudulent activity on your account. As always, please review your monthly statements carefully and let us know immediately if you notice any charges to your account that you don’t recognize.

Q: What are the chances that I become a victim of identity theft as a result of this incident?
A: It is important to know that Social Security numbers or addresses were not stolen, so we believe that the risk of identity theft is greatly reduced. In fact, fraud rarely occurs on accounts compromised during a data breach. However, it’s always a good idea to check your credit report regularly for incorrect information. In fact, you’re entitled to one free copy of your credit report every year at www.annualcreditreport.com or by calling 877-322–8228.

Q: What are you doing to protect my personal account information, especially in this case?
A: In partnership with Visa, Mazuma offers Members multiple layers of security protection against fraud, including Visa’s Zero Liability* policy, the ultimate protection for cardholders. With Zero Liability, consumers are not responsible for any unauthorized purchases made on their Visa cards.

Q: What can I do to ensure this doesn’t happen to me again?
A: While we employ the latest systems and technology to monitor and prevent card fraud, and many merchants also take the necessary precautions to protect your card information, there are some practical steps you can take to help protect yourself:

• Check your account statement promptly and immediately report any transactions that you don’t recognize.
• Destroy all receipts before discarding them since some of them may have your card number printed on it.
• Guard your card — don’t use it as collateral or give out your card number to someone on the phone, unless you initiated the call for a purchase.
• Check your credit report at least annually to ensure its accuracy.
• Register your card to use Verified by Visa and shop online with merchants that participate in the Verified by Visa service. This provides additional protection against unauthorized use of your card online.

Q: What should I do if I experience fraud on my account?
A: Let Mazuma know immediately if you see unauthorized purchases by calling 816-361-4194, toll-free 888-361-4194.

Q: Are there any other tips you can provide to reduce my chances of card fraud?
A: Yes.

• Shred all personal and financial information — such as bills, statements, ATM receipts and credit card offers — before you throw it away.
• Keep your personal documentation (e.g., birth certificate, Social Security card, etc.) and your credit union and credit card records in a secure place.
• Call the post office immediately if you are not receiving your mail. To get the personal information needed to use your identity, a thief can forge your signature and have your mail forwarded.
• Be aware of your surroundings when entering your Personal Identification Number (PIN) at an ATM.
• Limit the number of credit cards and other personal information that you carry in your wallet or purse.
• Report lost or stolen credit cards immediately.
• Review and consider whether you need currently inactive card accounts. Even when not being used, these accounts appear on your credit report, which is accessible to thieves. If you have applied for a credit card and have not received the card in a timely manner, immediately notify the appropriate financial institution.
• Closely monitor the expiration dates on your credit cards. Contact the credit issuer if the replacement card is not received prior to your credit card's expiration date.
• Sign all new credit cards upon receipt.
• Review your credit reports annually.
• Use passwords on your credit cards, Mazuma account and phone cards. Avoid using the obvious passwords — your mother's maiden name, your birth date or the last four digits of your Social Security or phone number.
• Match your credit card receipts against monthly bills to make sure there are no unauthorized charges.

DON'T ...

• Volunteer any personal information when you use your credit card.
• Give your Social Security number, credit card number or any credit union account details over the phone unless you have initiated the call and know that the business that you are dealing with is reputable.
• Leave receipts at ATMs, bank counters or unattended gasoline pumps.
• Leave envelopes containing your credit card payments or checks in your home mailbox for postal carrier pickup.
• Record your Social Security number or passwords on paper and store them in your wallet or purse. Memorize your numbers and/or passwords.
• Disclose credit union account numbers, credit card account numbers or other personal financial data on any Web site or online service location, unless you receive a secured authentication key from your provider.

*Visa’s Zero Liability policy covers U.S.-issued cards only and does not apply to commercial credit cards, ATM transactions or PIN transactions not processed by Visa. Cardholders must notify card issuers promptly of any unauthorized use. Consult issuer for additional details or visit www.visa.com/security.