TJX, Banks Settle Litigation Over Breach

Although both sides said the settlement total would remain confidential, TJX spokeswoman Sherry Lang said the costs were included in a $107 million reserve included in the company's second-quarter report for fiscal 2008.

The two sides said the settlement reimburses the banks for a negotiated portion of the costs and expenses the banks incurred, but not including attorney fees.

Three New England state bank associations that brought the case last spring along with three banks also are recommending that other banks accept an agreement TJX reached Nov. 30 with Visa and TJX's payment processor, Fifth Third Bancorp. Under that agreement, TJX would pay as much as $40.8 million to help U.S. Visa card issuers such as banks recover expenses to replace customers' payment cards, which typically costs around $20 per card.

That deal hinges on banks agreeing to participate, and doesn't include other card networks like MasterCard. By taking part, the banks agree to waive rights to sue TJX and Fifth Third, in exchange for being paid for their breach-related costs by Dec. 27.

TJX's settlement Tuesday is with state banks associations in Massachusetts, Connecticut and Maine, as well as Eagle Bank, Saugusbank and Collinsville Savings Society. The banks had sought unspecified damages.

After initially disclosing the data heist in January, TJX said in March that at least 45.7 million cards were exposed to possible fraud in a breach of its computer systems that began in July 2005. But the breach wasn't detected until December 2006.

Recent court filings by the banks that sued TJX put the number of cards affected at more than 100 million, based on estimates by officials with Visa and MasterCard, who were deposed in the lawsuit. It's believed to be the largest data breach ever, based on the number of customer records involved.

Framingham, Mass.-based TJX is the owner of about 2,500 stores including T.J. Maxx and Marshalls.