The Information Commissioner’s Office (ICO) said this morning that it had started an investigation into whether security procedures at TK Maxx, the retailer from which millions of British customers’ credit card details were stolen, were inadequate.

The ICO said that it had contacted the British headquarters of TJX, the US company that owns TK Maxx, to discuss details of the breach and assess whether there may be grounds for prosecution under the Data Protection Act.

“We want to talk to them about their security procedures, find out what’s gone missing and ensure that rigorous procedures are put in place to prevent a similar thing happening again," an ICO official said.

"If they are found to have breached the Act, there are a range of enforcement powers at our disposal.”

TK Maxx customers who had shopped at the store between January 2003 and June 2004 were advised to check their bank statements for suspicious activity and to contact the card issuer if any was found.

“Most people don’t do thousands of transactions a month, so it should be easy to recognise an instance of fraud,” Apacs, the UK payments association, said.

Customers whose details have been used fraudulently would be compensated by their bank, an Apacs official said, and all the cards on which fraud may have been committed would now have expired, so there was no danger of future financial loss.

“A breach of customer details on this scale is unprecedented." the Apacs official said. "What retailers must realise is that they’re no longer just selling goods — they’re guarding people’s data and they have a duty to protect this data in a responsible way."

Consumer organisations added their weight to calls for businesses to tighten security procedures.

“Companies need to take a very active stance to make certain their databases are not compromised and guard against the increasingly sophisticated hacks that are being committed,” a Which? official said.

Tony Herbert, of the charity Citizens Advice, said: “People need to feel their information is safe when using credit and debit cards, and more needs to be done by businesses to ensure that this doesn’t happen again.”

The breach, in which 45.6 million credit card numbers were stolen from the company’s computer systems, including one in Watford, came as the credit card industry tried to introduce new measures that would place a greater onus on businesses to protect data.

The Data Security Standard sets out minimum standards for computer databases, and has been devised by companies such as Visa and Mastercard in an attempt to get businesses to shoulder some of the responsibility for credit card losses caused by fraud, which totalled £439.4 million in 2005.

A Visa official said: “This incident serves as a powerful reminder of the importance of every business that handles payment card information adhering to the highest data protection standards to protect the security and privacy of their customers’ financial information.”

Companies that are found to have had lax security can be prosecuted under the Data Protection Act, but typically this would happen in a magistrate’s court, where the maximum fine is £5,000.

Times Recommends

• Lies and cover-up at MG Rover exposed by report
• High oil prices push manufacturing costs up
• Primark founder steps down as chief executive