Projo Biz Blog

TJX Cos., owner of T.J. Maxx, Marshalls and A.J. Wright stores, said the company and nearly all the banks and bank associations that sued the discount retailer over a massive credit card data breach have settled the lawsuit for an undisclosed amount.

Although both sides said the settlement total would remain confidential, TJX said the costs were covered by a $107 million reserve that it set aside against its second-quarter earnings.

TJX also has said that $107 million would cover the costs of another breach agreement: a Nov. 30 deal with Visa Inc. to help pay a maximum $40.9 million to help the network's card-issuing banks recover expenses to replace customers' Visa cards.

Between the two agreements and costs of about $125 million to boost security, TJX appears in good position to financially manage breach-related expenses, said Avivah Litan, a security analyst with Gartner Inc.

"This was a big thorn in their side," Litan said. "It was costly, but in the end, it's just one blip on their balance sheet."

Framingham, Mass.-based TJX, with $18 billion in annual revenue and 2,500 stores including T.J. Maxx and Marshalls, also faces pending state and federal investigations into the breach, which could result in fines.

And one of the small banks that sued TJX last spring didn't agree to sign onto Tuesday's settlement, filed in U.S. District Court in Boston.

Alabama-based Amerifirst Bank declined to take part in a deal that included state associations representing hundreds of banks in Massachusetts, Connecticut and Maine, as well as Massachusetts-based Eagle Bank and Saugusbank, and Connecticut-based Collinsville Savings Society.

"Those parties obviously felt they did what was in their best interests, but we feel that TJX caused a grave injustice to banks across the country, and many of those banks are small community banks like Amerifirst," said Inge Johnstone, a lawyer for the bank. "We have a duty to continue representing our clients, and this case continues for Amerifirst."

The banks sought unspecified damages for costs including expenses to reissue customers' credit cards and monitor for fraud.

After initially disclosing the data heist in January, TJX said in March that at least 45.7 million cards were exposed to possible fraud in a breach of its computer systems that began in July 2005. But the breach wasn't detected until December 2006.

Recent court filings by the banks that sued TJX put the number of cards affected at more than 100 million, based on estimates by officials with Visa and MasterCard, who were deposed in the lawsuit. It's believed to be the largest data breach ever, based on the number of customer records involved.

Stock in TJX (TJX:NYSE) closed Tuesday at $29.42 a share, up 51 cents.

-- The Associated Press

---