TJX Bleeding Continues Long After Data Breach Is Plugged

Implications: TJX has spent more than $216 million due to a lapse in data security after cyber thieves may have hacked into a wireless hub used for TJX's store controller that handles  their POS (Point-of-Sale) system.  Once the thieves gained access they may have been able to work their way into TJX's central system and compromised over 45 million credit and debit accounts, as well as checks and returned merchandise without receipts at stores in the U.S., Puerto Rico, Canada and the UK.  However, despite the data breach TJX reported Q207 revenue of $8.4 billion, a 7% increase from the $7.8 billion reported during the same quarter in 2006. As State Attorney Generals in 37 states assess the potential customer losses they will sue TJX to recoup damages from reissuing cards and customer loss from fraud and TJX has set aside a $100 million reserve to cover potential losses. Authorities believe there may be a break in the case after a suspect was arrested this week in the Ukraine.

Analysis: Comments/Perspective:

TJX's customers doesn't appear to be giving up on the giant retailer despite the magnitude of TJX's data breach that has affected more than 45 million credit and debit card account holders and the breach doesn't seem to be impacting TJX's bottom line in Q207.  In fact, TJX has set aside an after tax reserve for potential cash liabilities from pending litigation, investigations and other claims, as well as legal costs and other expenses as a result of a data breach.  Considering the costs of updating security systems for a retailer as large as TJX and the legal fees that may arise from numerous  civil lawsuits, the  potential costs to plug the data breach aren't large figures because TJX may  face small jury awards and some of the litigation may not make it to a jury. 

1.  The thieves in the  TJX case probably got caught because they were impatient and made numerous hits on Walmart and Sam's Club stores by buying hundreds of store-valued gift cards for $400 each, just under the $500 threshold for attracting scrutiny of gift card purchases.  However, because the gift card purchases were seen as suspicious, Walmart called in the local police in FL and the thieves were arrested and linked to the TJX breach 

2.  The final costs of the TJX data breach may be a bitter pill to swallow for a company who may be proven to not have done anything wrong and was a victim who's system was compromised by sophisticated cyber thieves who may have had a network of criminals and a team of tech savvy criminals spanning from the U.S. to the Ukraine

The finger pointing may continue long after the TJX data breach is  resolved and some consumer advocacy groups are pushing for immediate notification of all breached accounts, to force banks to reissue new cards and accounts and other advocates want to mandate credit monitoring services to protect consumers data and identify from fraud. For now, the date rages on!