He cited an ongoing investigation by his office, along with other states, into violations of consumer protection laws.

TJX Companies, Inc. (TJX), operator of TJ Maxx, Marshalls, HomeGoods and A.J. Wright stores, recently reported that its computer systems were hacked late last year, and that customer data was stolen.

Company officials said the hackers broke into a system that handles credit, debit card and check transactions, as well as merchandise returns for customers nationwide.

TJX recently notified nearly 18,000 Connecticut consumers whose personal identification information (driver's license, military identification, and state identification cards) may have been compromised and encouraged them to contact the Department of Motor Vehicles (DMV) to ensure their identities are not stolen.

For better protection, Connecticut licenses and identification cards - unlike other states - are assigned a unique identifying number, rather than the cardholder's social security number. However, Blumenthal recommended several steps consumers should take or consider to protect against identity theft.

"We are vigorously investigating this massive security breach - irrevocably impacting millions of TJX consumers," Blumenthal said. "We will examine whether consumer protection law violations occurred - and what protections TJX has implemented to prevent future security breaches. This gross security failure now requires consumer action to protect against indefinite threat of theft - placing fraud alerts and security freezes on credit reports, and vigilantly monitoring credit.

"In an era when debits replace dollars in purchases, companies have a moral and legal obligation to protect consumers' personal, private information."

Consumers who believe their identity has been stolen or their accounts or information compromised, should take the following steps:

• Consider contacting any one of the following credit bureaus and ask that it place a fraud alert on your credit report:
  • Equifax: 1-800-525-6285; P.O. Box 740250, Atlanta, GA 30374;

  • Experian: 1-888-EXPERIAN (397-3742); P.O. Box 1017, Allen, TX 75013;

  • TransUnion: 1-800-680-7289; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92634.

Once one of these companies is contacted it will then contact the others. The initial alert is valid for only 90 days and an identity theft report must be filed with each credit bureau in order to obtain an extended, seven-year alert.

Consumers should also request a free copy of their credit report to determine if the information in their credit report is accurate.

To order a free annual report from one or all the national consumer reporting companies, visit annualcreditreport.com, call toll-free (877) 322-8228, or complete the Annual Credit Report Request Form and mail it to:

The credit report request form is available at: www.ftc.gov/credit.

• Immediately contact the fraud department of each business or financial institution with which they have an account that has - or could have been - tampered with or opened fraudulently. Consumers should close all accounts that have been tampered with, and dispute in writing all suspicious transactions. Follow up with each company in writing.

• Contact local police and get a copy of the police report, because it may be requested by some companies or agencies investigating the theft or fraudulent use of personal information. Under state law, identity theft is a Class D Felony, punishable by one to five years in prison and a fine.

• Consider contacting each credit bureau to request a "Security Freeze" on your credit report. Identity thieves often try to open new credit accounts in a victim's name, and merely placing a "Fraud Alert" on an account does not block new credit cards from being issued. A "Security Freeze" prohibits credit bureaus from releasing a consumer's credit report or any information without their express authorization. The request must be made in writing by certified mail to each credit bureau (addresses below), upon which, the credit bureau must place the security freeze not later than five business days after receipt of the request. Within 10 days after placing a security freeze on a consumer account, the credit bureau will provide the consumer with written confirmation of the security freeze and a unique personal identification number, which the consumer will need if they wish to lift the freeze for a particular third party or for a period of time. Credit bureaus may charge a fee of $10 to initiate a freeze and $12 to temporarily lift a freeze; consumers may have the freeze temporarily or permanently removed at any time.
  • Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348

  • Experian, P.O. Box 9554, Allen, TX 75013

  • TransUnion Fraud Victim Assistance Department P.O. Box6790 Fullerton, CA 92834
    

• Consumers should file a complaint with the Federal Trade Commission, by phone at 1-877-IDTHEFT (1-877-438-4338), or by mail at Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue N.W., Washington, DC 20580.
  For additional information on identity theft, visit the following web sites:

  • Department of Justice
  • FDIC
  • Postal Inspectors
   
• State law entitles consumers to require credit rating agencies to block and not report information appearing on their credit report to inquiring companies as a result of an identity theft crime. The consumer must submit the request in writing and include proof of identity and a copy of the police report of the crime.

• Identity theft victims may bring a civil action against an identity thief to recover damages.

• To speak with TJX directly, the company has set-up a special toll-free number to respond to consumer inquiries: 1-866-430-0275

  ---