TJX Confronts Another Big Bill Linked to Card-Data Breach

The bills from the computer hacking at off-price retailer The TJX Cos. that compromised at least 45.7 million credit and debit cards keep rolling in. The Framingham, Mass.-based operator of the T.J. Maxx, Marshalls, and other chains took a pre-tax charge of $20 million ($12 million after-tax) to cover investigative, technology, legal, and other costs associated with the intrusion in its first fiscal 2008 quarter ended April 28, according to the quarterly report TJX filed last week with the Securities and Exchange Commission. That's on top of the $5 million pre-tax charge the company took in fiscal 2007's fourth quarter. That brings the merchant's pre-tax charges to $25 million?with no end in sight. TJX plans to take a charge of 2 cents to 3 cents per share in the second quarter, which could total up to an amount approximately equal to the 3-cent charge it took in the first quarter. The company said it can't yet estimate its costs for the third and fourth quarters. Meanwhile, the culprits are still at large despite investigations by public authorities, TJX's own staff, and the high-powered consultants TJX hired after it discovered the breach in December, International Business Machines Corp. and General Dynamics Corp. “We do not know who took this action, whether there were one or more intruders involved, or whether there was one continuing intrusion or multiple, separate intrusions,” the first-quarter filing says. Investigators have determined that the intruder or intruders first gained access to the company's payment-related computer systems last July, though the data they apparently gained access to went back as far as Dec. 31, 2002 (Digital Transactions News, March 29). The company now faces more than 20 class-action lawsuits and related actions filed in state and federal courts on behalf of customers, financial institutions that reissued cards, and shareholders, in addition to lawsuits in Canada. Many of the suits also name Cincinnati-based Fifth Third Bancorp, parent company of TJX's U.S. merchant acquirer. “TJX intends to defend all of these actions vigorously,” the filing says. Also, some 37 state attorneys general are now participating in an investigation into the breach. So far the breach hasn't taken a serious bite out of TJX's financials. The company last month reported first-quarter net income of $162.1 million, down 1% from $163.8 million a year earlier. While net sales from continuing operations rose 6% to $4.1 billion, same-store sales increases of 2% came in slightly below plan. But TJX president and chief executive officer Carol M. Meyrowitz said results were still within the company's expectations, and she blamed bad weather in many locales for putting a damper on sales.