T.J. Maxx owner pays $9.75 million, settles with 41 states over massive data breaches

Massachusetts-based TJX Cos. reached an agreement with 41 states attorneys general over data breaches that could have released as many as 100 million credit and debit card numbers collecting from customers.

Using stolen card numbers allows thieves to steal identities and make fraudulent transactions.

Under the settlement, TJX has agreed to pay a total of $9.75 million. The money will:
  • Provide $2.5 million to establish a new data security fund for the states,
  • Pay a $5.5 million settlement along with $1.75 million to cover expenses related to the states' investigations;
  • Certify that TJX's computer system meets detailed data security requirements,
  • Encourage the development of new technologies to address vulnerabilities in the payment card system.

"Safeguarding personal information isn't just good business, it's crucial for our economy," Washington state Attorney General Rob McKenna said.

The company -- owner of T.J. Maxx, Marshalls, HomeGoods and A.J. Wright -- announced the breaches in January 2007 and said they happened in 2005 and 2006. TJX said 11 people accused of participating in the data thefts have been indicted -- with a total of four pleading guilty to varying charges.

CVS Caremark also agreed to a settlement today with the Federal Trade Commission after that company was accused of carelessly dumping private records -- from medical information to Social Security numbers to payroll information -- in trash receptacles instead of destroying them. The FTC said the company did not have a reasonable program in place to dispose of such records and deceived consumers with such claims as "CVS/pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your health information."

CVS agreed to pay $2.25 million to settle the case.

States participating in the TJX agreement agreement include: Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Hawaii, Idaho, Illinois, Iowa, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Dakota, Tennessee, Texas, Vermont, Washington, West Virginia and Wisconsin.
Read Full Story