Complain about a product or service

TJX To Pay Mastercard $24 Million For Data Breach

Will set aside money to provide restitution for victims

By Martin H. Bosworth
ConsumerAffairs.com

April 6, 2008

The restitution does not go to cardholders, but to banks and other lenders that provided the cards. The funds will be set aside in an "Alternative Recovery Program" to help issuers recover costs and losses caused by the breach. The agreement must be approved by card issuers representing at least 90 percent of the affected Mastercard accounts.

"This agreement reflects MasterCard's continuing commitment to working with merchants and our customers to reach appropriate and fair resolutions of data breach events," said Joshua Peirez, chief payment system integrity officer for MasterCard Worldwide. "We believe that by working closely and cooperatively with issuers and merchants we can reduce the overall impact and costs of security breaches, while protecting consumers and accelerating fair and equitable resolutions of claims."

Issuers who take up the agreement must agree to not pursue any other means of loss recovery, and they must release Mastercard and TJX from all liability incurred as a result of the breach.

The announced agreement comes two days after the Federal Trade Commission (FTC) announced it had settled with TJX over fallout from the breach by mandating that the retail chain submits to independent third-party security audits every other year for the next twenty years.

TJX had already paid $41 million to Visa to settle costs and losses incurred by that card issuer as a result of the breach, which Visa executives estimated cost between $65 and $83 million. The Framingham, Massachusetts-based company also brokered a separate settlement with a coalition of Massachusetts-based banks that had sued TJX, the terms of which remain undisclosed.

The TJX breach occurred when unidentified hackers used laptop computers enabled with wireless access to intercept unencrypted payment data transmissions between scanners at TJX-owned store chains such as TJ Maxx and Marshalls.

About 455,000 Visa and Mastercard debit and credit card holders had personal information stolen during the breach, and as many as 94 million users were exposed. The breach went on for nearly two years, and was discovered in December 2006, but not made public until January 2007.

To date, the only settlement offered to actual cardholders by TJX consisted of an offer of free credit monitoring for cardholders who had information stolen in the breach, a $30 store voucher, and an announced three-day "Customer Appreciation Sale" to be held in 2008.

The Attorney Generals of ten states wrote the judge presiding over the offered settlement asking him to reconsider, saying the offers benefited the TJX chain more than they did the affected consumers.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Follow us on Twitter.

Back to the top |