EUGENE, Ore. — Several credit unions have rejected the multi-million dollar settlement with TJX Cos., because the payment won't cover the expenses causes by the retail giant's massive data security breach.
"I think a lot of credit union folks are disappointed," said Steve McIntyre, general counsel for SELCO Community CU, who said his CU voted against the settlement because it's share of the $40.9 million disbursed by TJX would fall far short of the tens of thousands of dollars in fraud losses and costs to reissue 14,363 Visa credit and debit cards exposed in the data breach.
Commonwealth CU, Frankfort, Ky., also rejected the settlement. "It's just a pittance for what we lost," said Gary Wallace, CEO of the $650-million credit union. According to documents provided by TJX, Commonwealth CU would have received $5,900 as part of the settlement, far less than the more than $100,000 — including some $40,000 in fraud-related losses — incurred by the CU to stem the breach. Those costs included notification to members and cancellation and reissuance of 10,000 Visa credit and debit cards. "Their percentage just doesn't add up," said Wallace.
HarborOne CU also rejected the settlement offer, finding the $7,000 payment it was expected to receive inadequate to pay the more than $100,000 it incurred in fraud losses and costs to reissue 10,000 Visa cards.
Jim Blake, CEO of the $1.5-billion CU, noted that to accept the offer would have prevented them from pursuing additional damages in court from TJX. He said his CU is still recording card fraud they believe is related to the TJX case. "The question is, how much more is going to come in the pipeline down the line?" said Blake.
Representatives of the three CUs said they are exploring their options in the case, which includes filing suit against TJX. Blake said that information being revealed in ongoing suits against TJX may be useful later on in case of a lawsuit.
Other credit union representatives dissatisfied with the settlement said they are also exploring their legal options, though it is believed that the majority of CUs will accept the settlement.
But if CUs want to challenge the settlement in court, they may have to do it individually because of a federal court ruling last month rejecting class-action status for the affected financial institutions and remanding the case to a state court in Massachusetts. SELCO Community, which reissued 14,363 Visa cards after learning about the breach, has appealed the court's ruling.
The CU executives acknowledged the difficulty of challenging TJX, operator of 2,500 retail stores across the country, in court. "It may not be economical," said Wallace, "we have to determine what we expect to gain from this." The CU did not file a bond claim with its insurer, Chubb Insurance, because the deductible exceeded the losses, according to Karen Harbin, EVP of Commonwealth CU.
TJX, which may have exposed records as many as 100 million consumer records to hackers, gave card issuers just three weeks to decide whether to accept the settlement, which it said was contingent on approval of 80% of the affected financial institutions. However, when the company announced Dec. 20 that it received 95% approval it said that was 95% of the "eligible accounts" affected, leaving many credit union representatives scratching their heads in confusion.
Dan Egan, who heads the Massachusetts, New Hampshire and Rhode Island credit union leagues, said CU representatives around New England acknowledged that their share of the settlement would not cover most expenses but were weary about pursuing the case in court, especially in light of the court's rejection of class status. He said many of the smaller CUs had small losses that make it uneconomical to file their own suits.
The $40.9 million in payments, which was mailed to credit unions and banks on Dec. 27, was just part of a series of settlements by TJX, including payments to affected consumers, that are expected to exceed $200 million.
The $40.9 million, however, only covers issuers of Visa, and not MasterCard, which has yet to settle issuer claims.
TJX is one of the biggest retailers in the country, operating more than 2,500 TJ Maxx, Marshall's, HomeGoods, AJWright, Bob's and HomeSense stores.
(c) 2008
