Discount retailer TJX Companies said on Friday it agreed to a settlement with Visa and Fifth Third Bancorp under which it will pay up to $40.9 million related to a security breach that put millions of shoppers’ credit card data at risk.
The parent of the T.J. Maxx and Marshalls clothing chains said the pre-tax payout will go to eligible U.S. Visa issuers that issued cards potentially affected by computer breaches.
Visa, meanwhile, agreed to suspend or rescind various fines it had imposed against Fifth Third, TJX’s card processor.
TJX, based in Framingham, Massachusetts, on March 29 disclosed that hackers had stolen data from about 45.7 million credit and debit cards from July 2005 through January 2007, covering transactions dating as far back as December 2002.
The theft is one of the world’s largest reported security data breaches, based on the number of affected accounts.
Visa Chief Executive Carol Meyrowitz and Fifth Third spokeswoman Stephanie Honan in separate statements said the settlement constituted a fair recovery to eligible issuers.
Ellen Richey, Visa’s head of global risk management, in a statement said card issuers that join the settlement will get “immediate recovery on their data breach claims.” Visa is based in San Francisco, and Fifth Third in Cincinnati.
TJX said the settlement cost is already reflected in a $118 million second-quarter charge it took for data breaches. It said issuers with at least 80 percent of the eligible accounts must agree to the settlement by Dec. 19 for it to take effect.
The company disclosed the settlement in a U.S. Securities and Exchange Commission filing.
In September, TJX agreed to settle related class-action lawsuits brought on behalf of customers in the United States, Puerto Rico and Canada.
On Thursday, U.S. District Judge William Young, who sits in Boston, ruled that banks suing TJX and Fifth Third cannot pursue their claims in a class-action lawsuit.
He wrote that he had “serious doubts” that the class was properly defined, and that it would often not be obvious whether a bank’s injuries stemmed from data breaches or unrelated fraud. The judge also said there were too many “individual questions touching on fundamental issues.”
Fifth Third’s Honan said the bank was “certainly pleased” with the decision. Banks remain free to pursue their claims separately, but likely at higher cost.
In late morning trading, TJX shares rose $1.07, or 3.8 percent, to $29.15 on the New York Stock Exchange, while Fifth Third rose $1.02, or 3.6 percent, to $29.66 on the Nasdaq.
