TJX settles data breach lawsuits

TJX's total losses from the 2005 data breach have risen to $128m

TJX, owner of the TK Maxx brand, has agreed to settle a series of class-action lawsuits stemming from a huge data breach in 2005.

Victims of the credit card heist will be divided into two camps. Customers who had credit card and personal identification information stolen and used fraudulently will be entitled to three years of free credit monitoring and identity theft insurance.

This will be shortened to two years for customers who had already accepted an earlier insurance offering. TJX will also refund any costs for replacing ID documents as a result of the breach.

The company said that the identification data was collected when the company accepted merchandise returns without receipts.

The second camp of customers who had only credit card information stolen in the 2005 breach will be offered vouchers for in-store use.

TJX said that customers will not be able to file claims until the settlement is formally approved by the court.

The company estimates that the settlements will bring its total losses from the data breach to roughly $128m.

The problems occurred over an 18-month period covering 2005 and 2006 at the company's database in Massachusetts.

TJX estimates that information from 45 million customers worldwide had been compromised, although only around 11 million had valid credit card data stolen.

Some of the stolen data was used in an $8m Florida shopping spree in March 2007 that led to arrests or warrants being issued for 10 people.