T.J. Maxx Breach Costs Hit $17 Million

The massive security breach at TJX Companies, Inc. continues to take its toll on the retailer.

The company announced in its first quarterly earnings statement that it took a $12 million hit, or 3 cents per share, because of the loss of more than 45 million credit and debit card numbers that were stolen from its IT systems over an 18-month period. It's considered to be the largest customer data breach on record.

TJX, the parent company of T.J. Maxx, Marshall's, HomeGoods, and other retailers, reported that its net sales from continuing operations for the first quarter of fiscal 2008 increased 6% to $4.1 billion. However, those earnings also included an after-tax charge of $12 million for costs incurred to investigate and contain the intrusion, improve computer security and systems, and communicate with customers, as well as technical, legal, and other fees.

The company also reported that it expects that in the second quarter, it will "continue to incur these types of costs related to the intrusion(s)." And TJX also estimates that those costs will total 2 cents to 3 cents per share.

"Beyond these costs, TJX does not yet have enough information to reasonably estimate the losses it may incur arising from this intrusion, including exposure to payment card companies and banks, exposure in various legal proceedings that are pending or may arise, and related fees and expenses, and other potential liabilities and other costs and expenses," the earnings reported stated.TJX had recorded a fourth-quarter charge of about $5 million for similar costs related to the security breach. That means at the end of the first quarter, the breach had already cost the company $17 million.

IPLocks, a compliance and database security company, released a report earlier this month estimating that the TJX breach will eventually cost the company $100 per lost record, or a total of $4.5 billion. The company based the estimate on the accumulated costs of fines, legal fees, notification expenses and brand impairment, according to Adrian Lane, the company's chief technology officer.

Last month, TJX was hit with a class-action lawsuit seeking tens of millions of dollars. The Massachusetts Bankers Association, which represents 207 financial institutions, announced that it is filing the suit in federal court in Boston.