FRAMINGHAM, Mass. – TJX Cos. Inc. will pay $9.75 million to 41 states for failing to protect customers’ financial information from a massive computer breach announced in 2007 that exposed millions of customers’ personal and credit card data to hackers, the company announced yesterday.
The settlement comes nearly two years after an out-of-court settlement between TJX and a number of financial institutions–including credit unions–for costs related to notifying cardholders and reissuing cards. Under the multi-state settlement, TJX, which operates discount retailers T.J. Maxx, Marshalls, HomeGoods and A.J. Wright, agreed to ensure that it’s safeguarding consumers’ data and addressing security system deficiencies that were in place when the breach occurred. The company also must report regularly to the attorneys general about how its data security program is working after it has a third party assess its systems. In its statement TJX said it “firmly believes that it did not violate any consumer protection or data security laws” but worked toward the settlement to eliminate the “distraction” of the case. In a statement today, TJX said it firmly believes that it did not violate any consumer protection or data security laws, and that its computer security was good as or better than most other major U.S. retailers at the time of the breach in 2005 and 2006. Under the settlement, TJX has agreed to: * Provide $2.5 million to establish a new Data Security Fund for use by the States to advance effective data security and technology; * Provide a settlement amount of $5.5 million together with $1.75 million to cover expenses related to the States’ investigations; * Certify that TJX’s computer system meets detailed data security requirements specified by the States; and The $9.75 million settlement payment includes $2.5 million to establish a data security fund for the states and $1.75 million to cover the states’ investigations into the data breach.
