Complain about a product or service

TJX Settles With Banks Over Data Breaches

Nearly 100 million consumers may have been affected

By Martin H. Bosworth
ConsumerAffairs.com

December 20, 2007

Terms of the settlement between the coalition of banks, led by the Massachusetts Bankers' Association (MBA), and TJX were undisclosed but TJX said the $107 million reserve fund it set aside to cover payments and legal expenses from the breach would cover the banks' agreement.

"The TJX experience underscores broader challenges facing the U.S. payment card system that require urgent action by merchants, banks, payment card companies and associations, and we look forward to greater cooperation in order to better serve and protect customers," said TJX president and CEO Carol Meyrowitz.

MBA president Daniel Forte said that the TJX data breach "and the ensuing litigation have clearly initiated an important nationwide dialogue on the importance of improving the security of the U.S. payment card system."

The banks' lawsuits suffered a setback on Nov. 30 when a Massachusetts judge ruled that they could not band together as a class and had to seek restitution from TJX individually. TJX, which admitted no fault in the settlement, urged the banks to accept a separate settlement it had negotiated with Visa on Nov. 30. Under that settlement, TJX would pay up to $40.9 million to plaintiff banks in exchange for their dropping lawsuits against the company.

Not every bank in the coalition is on board with the settlement. Alabama-based Amerifirst bank is proceeding with its own lawsuit, and TJX must contend with lawsuits filed by several state Attorneys General as well.

Although industry insiders viewed the settlement as a mutual agreement to put litigation aside in time for the holiday shopping season, the real victims of the breach--consumers whose data was exposed to potential identity theft--have been largely forgotten about. TJX offered a consumer settlement that consisted mainly of a special three-day sale and reimbursement for damages only after submitting extensive documentation.

Both TJX and the plaintiff banks have accused the other of failing to provide proper security for their payment transactions, and both have claimed greater compliance with industry standards since the breach was made public, but neither side is willing to make the results of their improvements public.

The TJX breach took place when hackers using laptops with wireless connections pirated information from TJX's payment network, including the credit and debit card numbers of 94 million Visa and Mastercard users. The breach has been called "the biggest ever."

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |