TJX puts cost for breach at $25m so far

TJX Cos. yesterday upped estimates of its costs so far to deal with a computer data breach to around $20 million, in addition to $5 million it had previously spent, and said it still cannot predict its final liability in the area.

Carol Meyrowitz, chief executive of the Framingham-based retailing giant, and other executives wouldn't take questions about the breach on a conference call with analysts yesterday.

But in a securities filing describing its earnings results for the three months ended April 28, the company said it "does not yet have enough information" to predict future costs in areas such as payments it may owe to credit card companies and banks and for various legal costs.

The language suggests the computer breach may become a long-running issue for the parent of stores including TJ Maxx and Marshalls. Since January, TJX has described itself as the victim of a computer intrusion that compromised data related to more than 45 million credit and debit cards.

Police are still investigating the case. So far the only arrests have been of a group of people in Florida believed to have used credit cards manufactured from data originally stolen from TJX. The scale of the breach makes it the largest on record and has led to much recrimination from banks that face millions of dollars in costs to replaced compromised accounts.

TJX already faces several lawsuits, including one by the Massachusetts Bankers Association, over these costs, plus investigations by regulators, including the Federal Trade Commission. Technology analysts have estimated the total cost to TJX may exceed $1 billion, including reduced revenue from lost business, though this could be offset by insurance or other arrangements.

Mary Ellen Callahan, partner in the Washington law firm of Hogan and Hartson who has represented other large corporations facing data-breach claims, said costs for technical fixes tend to be much lower than costs to address lawsuits and payments to processors. For TJX, "those costs are going to be astronomical," she said.

TJX shares fell 62 cents yesterday, to $27.75, after the company issued its results before trading. For the three months ended April 28, TJX had $162 million in profit on sales of $4.1 billion, compared with profit of $163 million on sales of $3.9 billion for the same period a year earlier. The company blamed lower-than-expected sales on unseasonably wet weather in some regions.

Some analysts said they don't expect the breach to become a major factor for the company, however, noting its same-store sales figures indicate that shoppers don't seem to be punishing the company by staying away from its stores. "I don't think the customer is reacting negatively to this," said CL King analyst Mark Montagna.

TJX had previously said it had spent $5 million to address issues following the discovery of the security breach. In its filing yesterday, TJX said during the three months ended April 28 it took an after-tax charge of about $12 million, or 3 cents per share, for costs to "investigate and contain the intrusion, enhance computer security and systems, and communicate with customers, as well as technical, legal, and other fees."

TJX says it expects to incur similar costs in the current quarter.

Ross Kerber can be reached at kerber@globe.com.