T.J. Maxx Security Breach Costs Soar To 10 Times Earlier Estimate

The theft of millions of customers' credit card information from TJX continues to wreak havoc on the retailing giant.

TJX, which is the parent company of retailers like T.J. Maxx, Marshalls, and HomeGoods, reported in its second-quarter earnings Tuesday that the company had to absorb a $118 million charge related to the massive security breach. For the second quarter, which ended July 28, the breach cost 25 cents per share -- 10 times more than the 2 cents to 3 cents company executives estimated just three months ago.

Earlier this year, TJX announced the loss of more than 45 million credit and debit card numbers that were stolen from its IT systems over an 18-month period. It's considered to be the largest customer data breach on record.

In May, TJX announced in its first quarterly earnings statement that it took a $12 million hit, or 3 cents per share. TJX earlier had recorded a fourth-quarter charge of about $5 million for similar costs related to the security breach. That means at the end of this last quarter, the breach has already cost the company $135 million.

The company estimated in its earnings report that executives expect to incur future noncash charges of about $21 million after tax, or 5 cents per share. Those charges could be recorded in fiscal year 2009. The company is now mid-fiscal-year 2008.

"We have continued to learn more about the computer intrusion(s) and are now able to estimate the company's liability," said Carol Meyrowitz, president and CEO of TJX, in a written statement. "Over the past months, we have worked diligently to further strengthen the security of our computer systems. Our customers remain our top priority, and I sincerely thank them for their support during this time."

Despite the security breach, customers are still shopping at the company's stores. Its net sales from continuing operations for the second quarter of fiscal 2008 increased 9% to $4.3 billion

"Our operating results mark the strongest second-quarter performance in the company's history and were achieved on top of very strong performance last year," said Meyrowitz. "Importantly, virtually all of our businesses delivered significant top- and bottom-line improvement that was in line with or above our plan."

IPLocks, a compliance and database security company, released a report in May estimating that the TJX breach will eventually cost the company $100 per lost record, or a total of $4.5 billion. The company based the estimate on the accumulated costs of fines, legal fees, notification expenses, and brand impairment.

In April, TJX was hit with a class-action lawsuit seeking tens of millions of dollars. The Massachusetts Bankers Association, which represents 207 financial institutions, announced that it was filing the suit in federal court in Boston.