TJX reaches settlement with states on data theft

Discount retailer TJX Cos. announced it has reached a settlement with multiple states related to the massive data theft occurred at the parent company of retailers T.J. Maxx and Marshall's a few years ago. The Framingham, Mass.-based company said it will pay $2.5 million to create a data security fund for states as well as a settlement amount of $5.5 million and $1.75 million to cover expenses related to the states' investigations. But TJX stressed that it "firmly believes" that it did not violate any consumer protection or data security laws. The breach, which was disclosed in January 2007, exposed tens of millions of payment card numbers to hackers. TJX has said that at least 45.7 million credit and debit cards were exposed to possible fraud in the computer systems breach that began in July 2005. The breach wasn't detected until December 2006. Under the settlement with a multi-state group of 41 Attorneys General, TJX must also certify that its computer system meets detailed data security requirements specified by the states and must encourage the development of new technologies to address weaknesses in the U.S. payment card system. Jeffrey Naylor, TJX Chief Financial and Administrative Officer, said: "This settlement furthers TJX's efforts to unite retailers, law enforcement, banks, and payment card companies to consider installing in the U.S. the proven card security measures that are already in use throughout much of the world." TJX previously agreed to pay card-transaction processors Visa Inc. and MasterCard Inc. nearly $65 million combined for the data breach.