TJX Cos. and New England banks yesterday said they have agreed to settle a high-profile lawsuit over payment card security practices in the wake of the record-setting data breach at the Framingham retailer that compromised up to 100 million accounts.
TJX, the parent of discount retail chains including TJ Maxx and Marshalls, will pay community banks and trade groups in Massachusetts, Connecticut, and Maine a portion of their legal expenses.
Specifics weren't disclosed, but the deal won't add to the $256 million TJX previously had budgeted to deal with the breach, a spokeswoman said yesterday.
In addition to settling with the banks, the figure is meant to cover previous settlements with payment card company Visa International Inc. for up to $40.9 million in costs, and with a class of consumers.
TJX still faces claims from an Alabama bank and probes by federal and state officials. Mary Monahan, partner at Javelin Strategy & Research in California, said the deal is a relative win for TJX and no surprise after a decision by a federal district court judge made it harder for the banks to join together to sue TJX as a class.
"Once that happened, it became too expensive for the banks to continue on this route," she said.
Both sides said they were pleased with the outcome.
Banks led by the Massachusetts Bankers Association had filed their suit in the spring as the extent of the data breach became clear, seeking to cover costs such as reissuing compromised cards.
TJX found illicit software on its systems at the end of 2006, and Canadian privacy officials tied the intrusion to a weakness in the company's wireless security systems dating back to 2005. Although officials have won convictions in Florida and elsewhere for misuse of the stolen card numbers to buy goods, to date no individual has been charged with the intrusion itself.
The bankers alleged that TJX was negligent in not maintaining stricter data security, and unearthed documents that showed the company wasn't meeting industry security standards.
TJX had denied the main allegations and faulted banks for failing to press for tougher security of their own.
As part of yesterday's deal, the bankers are recommending their members accept the repayments Visa is offering under the terms of its deal with TJX.
In statements yesterday, both sides said they hope the deal will improve overall security. "The TJX experience underscores broader challenges facing the US payment card system that require urgent action," said Carol Meyrowitz, TJX chief executive.
Daniel Forte, president of the Massachusetts Bankers Association, said the case was worth pursuing to show weaknesses in the payment system.
"This data breach and the ensuing litigation have clearly initiated an important nationwide dialogue on the importance of improving the security of the US payment card system," he said.
Ross Kerber can be reached at kerber@globe.com.
