Banks in region set to sue TJX over breach
Group says its plan reflects ire over lax security by retailers
A group of New England banks said it plans to sue TJX Cos. over a data breach at the Framingham retailing giant, setting up a broad clash between financial institutions that issue credit and debit cards and the stores that accept them.
Executives for the Massachusetts Bankers Association, whose members range from small community banks to powers like Bank of America Corp., said its members and banking executives in Connecticut and Maine will seek tens of millions of dollars in damages from TJX, which operates stores such as TJ Maxx, Marshalls, and HomeGoods. The banks plan to sue TJX today in US District Court in Boston.
This year, TJX disclosed that thieves were able to capture information on more than 45 million customer credit and debit cards it had stored in company computers as far back as 2003. Authorities say the data has since been used to commit fraud worldwide and would represent the biggest data breach ever.
TJX spokeswoman Sherry Lang said the company "will defend itself vigorously" but wouldn't comment on specific litigation.
Massachusetts Bankers president Daniel J. Forte said he believes the suit would be the broadest ever brought by banks over a data breach and reflects banks' growing frustration with retailers that, like TJX, don't meet technical standards for protecting their systems.
"Right now we've had major breaches from major retailers, and there's very little recourse and little incentive for them to change," Forte said in an interview yesterday.
Forte said he couldn't provide a more specific damages figure because Visa USA and MasterCard Inc. are still giving banks lists of card numbers that TJX has reported stolen.
"It's amazing that three months later, banks are still getting lists of hot cards from Visa and MasterCard," Forte said. "It means the issue isn't totally resolved."
Floyd Stoner, chief lobbyist for the American Bankers Association in Washington, which represents the country's largest banks, said he doesn't expect it will join the suit but that it supports the Massachusetts complaint.
"This suit is evidence of the degree of frustration felt by our members" over breaches at retailers, Stoner said.
Friction among banks, retailers, and card companies has been building in recent years in the face of growing fraud losses to data thieves. Currently, credit card networks require banks who issue most cards to notify consumers when their card numbers are compromised and to cover the costs of fraud losses and reissuing new cards.
Banking groups like Forte's call these rules unfair and have pressed for changes in the wake of past breaches like one at warehouse chain BJ's Wholesale Club Inc. of Natick. Among other things, they want Visa and MasterCard to begin to publicly identify merchants that suffer breaches, which could refocus ire from consumers.
A Visa spokesman said executives weren't available to comment yesterday. A MasterCard spokesman did not return messages. A spokeswoman for Bank of America, which issued cards that were among the first to be identified as compromised in the TJX matter, said it wouldn't discuss the lawsuit.
Past orders by US District Court Judge William G. Young meant the Massachusetts Bankers faced a deadline of today to file their case. The group said it was not prepared to release the full legal document yesterday.
The Massachusetts Bankers said they will pursue the action with sister bank organizations in Maine and Connecticut, representing roughly 300 banks in all. In a statement released yesterday, the group named plaintiffs including Saugusbank in Saugus, Eagle Bank in Everett, and Collinsville Savings Society in Connecticut. Executives at all three institutions did not return messages yesterday, and Bruce Spitzer, a Massachusetts Bankers spokesman, said he had directed all three to refer calls to the trade group.
TJX already faces more than a dozen lawsuits seeking damages over the breach, according to a recent securities filing. Most have been brought on behalf of consumers, but one action brought against TJX by AmeriFirst Bank of Alabama also seeks to represent financial institutions that will have to reissue credit cards at a cost of $20 each, for instance.
A question now is how Judge Young will treat the two banking suits. AmeriFirst lawyer Patrick Sheehan of Whatley Drake & Kallas in Boston said it will still pursue claims against TJX and against Fifth, Third Bancorp in Ohio, which processed some card transactions for TJX. Forte said that the AmeriFirst case is narrower than the one his group plans to bring which, among other things, will accuse TJX of violating rules against deceptive practices and misrepresentation.
Some technology analysts estimate that TJX could face more than $1 billion in total costs over the breach, including payments to banks and regulators and lost business. It's unclear how much TJX would have to pay directly. The company has declined to discuss the estimate in detail.
Ross Kerber can be reached at kerber@globe.com. 