A banker-led lawsuit against The TJX Cos. has been settled.
The Massachusetts Bankers Association, Connecticut Bankers Association and Maine Association of Community Banks, along with Saugusbank, Everett-based Eagle Bank and Connecticut-based Collinsville Savings Society, announced the settlement last week.
The financial terms of the settlement are confidential, but MBA said TJX, the Framingham-based parent company of Marshalls and TJ Maxx, has agreed to reimburse the settling plaintiffs for a negotiated portion of the costs and expenses, other than attorney’s fees, that they incurred.
“We settled because we achieved our objectives,” said MBA Director of Communications Bruce Spitzer. “The public is aware that banks were not at fault for the data breach, TJX is now PCI compliant [compliant with payment card industry data security standards], and generally, the protection of customer data has improved across the industry.”
Seventy percent of the country’s largest retailers are now PCI compliant, as opposed to just 40 percent six months ago, said MBA President Daniel J. Forte.
MBA filed the lawsuit in April, four months after TJX admitted that computer hackers had accessed consumer credit and debit card data in its computer system between May and December of 2006. It sought reimbursement for banks’ cost to replace compromised cards, a court order requiring TJX not to store customer financial data beyond points authorized in its contract with Chicago-based payment processor Fifth Third Bank, and a finding that TJX violated Massachusetts’ deceptive acts and unfair trade practice law.
Plaintiffs claimed TJX was negligent, misrepresented that it was protecting customer data and breached its contract terms within the network of credit- and debit-card merchant agreements – specifically, with Fifth Third Bank, which processes its Visa and MasterCard transactions.
TJX spokeswoman Sherry Lang released a statement saying all claims were dismissed as a result of the settlement.
The data breach, which compromised more than 45 million cards, has been called the largest in U.S. history. It reportedly has been traced to fraudulent credit-card purchases worldwide, although according to The Boston Globe, more than 95 percent of the cards had expired by the time TJX discovered the breach last December.
MBA, as well as the Connecticut and Maine bankers associations, recommended that their member banks that issue Visa cards accept the Visa Alternative Recovery Offer, separately negotiated between Visa and TJX. The offer expired Dec. 19.
Spitzer said he did not know how many accepted, but said banks that did so would have access to a portion of the $40.9 million TJX agreed to pay those who suffered damages, such as the cost of replacing compromised cards, during the breach. He said about 40 percent of Bay State banks issue Visa; the remaining 60 percent issue MasterCard.
The breach also affected American Express and Discover cardholders.
It is unclear whether MasterCard will issue its own Alternative Recovery Offer, although the company indicated in a recent statement that it probably will not do so. Banks’ other alternative, if they wish to claim damages, is to file individual claims against TJX in Massachusetts courts or participate in the existing claims process Visa and MasterCard have in place, he said. However, Spitzer previously has called that process cumbersome and said many banks don’t consider it worth the effort.
Massachusetts Credit Union League Chairman James Blake, the president and chief executive officer of HarborOne Credit Union in Brockton, said MCUL hasn’t signed on to any lawsuits. “Individual credit unions are making their own decisions based on existing methods for recovery,” he noted. “We’re waiting to see what kind of discovery takes place [in other pending lawsuits].”
