A hacker or hackers stole data from at least 45.7 million credit and debit cards of shoppers at off-price retailers including T.J. Maxx and Marshalls in a case believed to be the largest such breach of consumer information.

For the first time since disclosing the theft more than two months ago, the parent company of nearly 2,500 discount stores put a number on how much card data was compromised _ and it's a number TJX Cos. acknowledges could go still higher.

Experts say TJX's disclosures in a regulatory filing late Wednesday revealed security holes that persist at many firms entrusted with consumer data: failure to promptly delete data on customer transactions, and to guard secrets about how such data is protected through encryption.

"It's not clear when information was deleted, it's not clear who had access to what, and it's not clear whether the data kept in all these files was encrypted, so it's very hard to know how big this was," said Deepak Taneja, chief executive of Aveksa, a Waltham, Mass.-based firm that advises companies on information security.

The case has led banks to reissue cards to customers as a precaution against further fraud beyond cases detected as far away as Sweden and Hong Kong, according to the Massachussets Bankers Association, which is tracking fraud reports linked to Framingham, Mass.-based TJX, parent company of stores across North America and the United Kingdom.

The only arrests believed tied to the case involve a gift card scam in which 10 people are suspected of buying data from the TJX hackers to purchase Wal-Mart gift cards in northern Florida. The group _ who aren't believed to have committed the TJX hack _ then used the cards to buy $1 million worth of electronics and jewelry at Wal-Mart's Sam's Club stores, according to Gainesville, Fla., police.

Information from 45.7 million cards was stolen from transactions beginning in January 2003 and ending Nov. 23 of that year, TJX said in the filing with the Securities and Exchange Commission after business hours Wednesday. TJX did not estimate the number of cards from which information was stolen for transactions occurring from Nov. 24, 2003, to June 28, 2004.

TJX said about three-quarters of the 45.7 million cards had either expired at the time of the theft, or the stolen information didn't include security code data from the cards' magnetic stripes. Starting in September 2003, TJX began masking the codes by storing them in computers as asterisks rather than numbers, the company said.

The filing also said another 455,000 customers who returned merchandise without receipts had their data stolen, including driver's license numbers.

With at least 46 million consumer records accessed, the TJX case outranks the previous largest case tracked by the Privacy Rights Clearinghouse: a June 2005 disclosure by credit card processor CardSystems that hackers accessed accounts of 40 million card holders.

If convicted on federal charges, Christensen, 60, faces up to 30 years in prison and a $250,000 fine on each of two charges. In the federal system prisoners are not eligible for parole until they complete 85 percent of their sentence.

"We're distressed they're going to these lengths," said Christensen's lawyer, Jeffrey Pine, of Providence. "This is overkill."

US Attorney Robert Clark Corrente announced the charges against Christensen last Friday at a press conference launching Project Safe Childhood, a Department of Justice program targeting exploitation of children over the Internet.

Corrente's spokesman, Tom Connell, declined to respond to Pine's accusation.

"Any action we take in the case will take place in court," Connell said. "We will not engage in repartee in the newspaper."

Last week, in US District Court in Providence, Christensen was arraigned on one charge each of interstate travel to entice a minor in sexual conduct and using interstate commerce to entice a minor, according to Corrente's office. The retired software engineer, who is married with two grown sons, pleaded not guilty and was released on a $10,000 bond. He is confined to his home with an electronic monitoring bracelet, and is not allowed access to computers or the Internet. He also is prohibited from any contact with minors.

A woman who answered the phone at Christensen's Granuaile Road home declined to comment.

Federal prosecutors took over the case from Rhode Island's attorney general, who had charged Christensen with one count of indecent solicitation of a minor.

"Our mutual goal is to use the best possible laws to prosecute cases. In this case the federal laws pack more punch than the state laws," said Mike Healey, spokesman for the Rhode Island attorney general.

In December, Christensen received five years probation after pleading guilty in Plymouth Superior Court to soliciting sex on the Internet from a person he believed to be a 13-year-old girl. As in the Rhode Island case, the person was in fact a police officer.

"The distinction between 'political' and 'performance-related' reasons for removing a United States attorney is, in my view, largely artificial," Kyle Sampson told the Senate Judiciary Committee.

"A U.S. attorney who is unsuccessful from a political perspective ... is unsuccessful."

Democrats on the panel immediately rejected the concept of mixing politics with federal law enforcement. They accusing the Bush administration of cronyism and trying to circumvent the Senate confirmation process by installing favored GOP allies in plum jobs as U.S. attorneys.

"It corrodes the public's trust in our system of Justice. It's wrong," said Judiciary Committee Chairman Patrick Leahy. "When anybody tries a backdoor way to get around the Senate's constitutional duty and obligation of advise and consent, it does not sit well."

After being sworn, Sampson, who quit earlier this month amid the furor, disputed Democratic charges that the firings were a purge by intimidation and a warning to the remaining prosecutors to fall in line. Nor, he said, were the prosecutors dismissed to interfere with corruption investigations.

"To my knowledge, nothing of the sort occurred here," Sampson told the committee.

Kaye Steinsapir said she thought she was feeding her cat, Lila, one of the healthiest, most nutritious cat foods available.

"Lila was a healthy, vibrant cat without any medical conditions," said the lawsuit filed Tuesday in Los Angeles Superior Court. But in recent weeks, Lila began vomiting, drinking an excessive amount of water and was eventually diagnosed with acute kidney failure, the lawsuit said.

Complete list of recalled brands of pet food.

Gregory Helmer, a Los Angeles attorney retained by Steinsapir and Lois Grady of Sacramento, Calif., who alleges her cat, Riley, also became ill after eating tainted cat food, filed the lawsuit "on behalf of themselves and all others similarly situated."

Menu Foods recalled on March 16 several brands of dog and cat food products nationwide. Scientists at the New York State Food Laboratory last week identified the rodent poison aminopterin as the likely culprit in a scare that prompted the recall of 95 brands of "cuts and gravy" style dog and cat food by Menu Foods of Ontario, Canada.

A nonprofit provider of mental health services paid nearly $557,000 to settle allegations of improper billing to government health programs, the state attorney general's office said yesterday.

Tri-City Mental Health Center began reviewing employee complaints about irregularities in its government claims practices in 2003, and the nonprofit's board ordered an outside audit, Massachusetts Attorney General Martha Coakley said.

Tri-City reported the improper billing to the government in late 2004, and was never charged.

State and federal investigators found Tri-City Mental Health billed the state Medicaid program and the state Department of Mental Health for psychiatric services that were never provided or couldn't be documented.

The improper billing occurred for more than two years, starting in Sept. 2001 at a center in Malden.

At least one manager at the Malden office was fired as a result of Tri-City's internal investigation, Coakley said.

Ellen Dalton, a manager at Tri-City, said the improperly received government payments were used to fund the nonprofit's operations, not for any personal use by its nearly 500 employees.

Dalton said Tri-City set aside cash from recent years' operations, and has paid the $556,687 settlement total in full.

"The agency is ready to move forward, and no services will be disrupted," she said.

The nonprofit, which began operations in the 1960s, runs mental health centers in the neighboring communities of Malden, Medford, and Everett.

The settlement total equals the amount of money that investigators found had been improperly billed, plus interest, according to Dalton.

Under the settlement, Tri-City agreed to ensure future compliance with rules governing Medicare reimbursement.

The settlement relieves Tri-City and its board of any civil or administrative liability.

Coakley said Tri-City "has cooperated fully with the investigation."

Chipmaker Intel Corp. said on Thursday it will set aside $275 million less than it had planned for taxes as a result of a settlement with the U.S. Internal Revenue Service, and says its 2007 tax rate will be lower than expected.

The IRS told Intel on Tuesday it closed its examination of the chipmaker's tax returns for the years 1999 to 2002, resolving several issues, including the tax benefit for export sales. The two sides also agreed on the tax benefit for export sales for the years 2003 through 2005.

In connection with the settlement, the company expects to reverse previously accrued taxes, which will reduce the current quarter's tax provision and reduce the income tax rate for 2007 below the previous forecast of about 30 percent.

In February, Intel said it would appeal an IRS tax adjustment related to export sales that could increase its tax due by $2.4 billion from 1999 through 2006.

Intel has been contesting the issue since August 2003 when the IRS first gave it notice of the adjustment.