FRAMINGHAM, Mass. -
In the suit filed in federal court in Boston, banker groups from Massachusetts, Maine and Connecticut claim damages from TJX, the parent of TX Maxx, Marshalls, HomeGoods and several other chains, in the "tens of millions of dollars," for notifying customers recalling and reissuing cards. The three banking groups, the Massachusetts Bankers Association, Maine Association of Community Banks and Connecticut Bankers Association, represent almost 300 banks in the tri-state area.
TJX Officials did not return phone calls seeking comment.
Meantime, there has been little progress in a 2005 suit brought by 200 credit unions seeking recovery of more than $5 million from BJ Wholesale Club for losses caused by a data breach at that company.
Dan Egan, president of the Massachusetts CU League said hundreds of thousands of cards at as many as 60 credit unions throughout the three states he represents (New Hampshire and Rhode Island and Massachusetts), and countless others around the country accrued costs to protect their members from fraud and identity theft due to the TJX breach.
Egan said they could not yet quantify the damages to credit unions because incidents of fraud are ongoing and can be expected to trickle in the future.
In addition, he expects the data thieves to hold on to cards information so they can use it down the road.
James Blake, president of HarborOne CU and chairman of the Massachusetts League, who was burned in earlier breaches at BJ Wholesale and DSW Shoes, said he will bring a new claim into the civil litigation-claims for reimbursement for the damage done to his credit union's reputation.
"No one's put a figure on it, but we're going to," Blake said. HarborOne's reaction to protect members-recall of cards-not only cost the credit union more than $100,000 in the TJX case, but untold losses to its reputation, he asserted.
Recalling Cards
Like most credit unions, HarborOne routinely recalls cards that may have information stolen, even if there have been no incidents of fraud. But this approach, he lamented, serves to scare members and potential members and put his $1.4-billion credit union in a bad light publicly, as the average consumer does not know who is responsible for the repeated cards recalls.
TJX revealed last month that information on as many as 47.5 million credit and debit cards was stolen by hackers, who first got into its computer system in July 2005.
Blake said he hopes the TJX case will prompt lawmakers, on the state and federal level, to pass data security legislation with, among other things a provision that would require all cards issuers to recall and reissue all cards that have been compromised-just as most credit unions do. In contrast, some institutions wait until there has been fraud detected on an account before they recall the cards, he noted.
Blake said he was especially frustrated by the local retailer, which never responded to a letter sent on behalf of credit unions seeking an explanation and recompense for the huge data breach.
"Frankly, what makes this so upsetting is the response, or lack of response, by TJX," he said. Likewise, the chairman of the state credit union league was unable to get a response to inquiries made to Visa and MasterCard, seeking the name of a reported 200 retailers who have not complied with the card giants Payment Card Industry security standards.
The TJX suit is filed in the U.S. District Court for the District of Massachusetts and is styled: Massachusetts Bankers Association: Connecticut Bankers Association: Maine Association of Community Banks: Eagle Bank; SaugusBank and Collinsville Savings Society vs. The TJX Companies Inc.
