TJX Cos. learned its computer security had been breached as early as October of 2006, two months earlier than previously disclosed, an attorney for a bank suing the Framingham retailer said at a federal court hearing yesterday.
TJX, parent of discount retailers TJ Maxx and Marshalls, has said it first learned of an intrusion into its computer systems in December 2006. But as early as October of that year it learned of a problem with Discover payment cards and took four weeks to arrange for a review by a security vendor, said Joe R. Whatley Jr., an attorney for AmeriFirst Bank of Alabama at a hearing in federal District Court in Boston.
The detail could put additional pressure on TJX as it appears likely to face continuing claims from banks trying to recoup costs such as reissuing payment cards following the breach that compromised as many as 100 million customer accounts.
TJX vice chairman Donald Campbell said "TJX stands behind the facts that we have previously stated: It was not until on December 18, 2006, that TJX first learned that there was suspicious software on TJX's computer system, not until December 21, 2006, that we learned there was strong reason to believe our computer system had been intruded upon, and not until December 27, 2006, that we first learned that customer information had apparently been stolen." Discover did not respond to requests for comment.
The exact timing of the breach's discovery has become a hot issue recently, with TJX itself suggesting in separate court papers that Citigroup Inc. may have known of fraudulent purchases at TJX earlier in 2006.
TJX previously had won a legal victory when a federal judge declined to grant class action status to banks suing TJX. Yesterday's hearing was chiefly on procedural questions as Young remanded the case to Massachusetts courts.
Whatley said after the hearing that AmeriFirst and other banks likely will continue to seek recovery and that many banks have significant claims to press. They have so far been offered less than 3 percent of their losses in some cases, he said, and one bank that suffered $150,000 in losses has received an offer of just $68.
Ross Kerber can be reached at kerber@globe.com.
