Banks are Preparing Lawsuits Against TJX Over Credit Card Data Breach

The Massachusetts Bankers Association (MBA) announced that it is filing a class action lawsuit in U.S. District Court in Boston against Framingham, Mass.-based TJX Companies Inc. in response to the company’s credit and debit card data breach in which more than 45 million cards may have been compromised. The suit will seek to recover damages in the “tens of millions of dollars,” and the Connecticut Bankers Association (CBA), the Maine Association of Community Banks (MACB), and individual banks, are joining the MBA as co-plaintiffs.

The three bankers associations represent nearly 300 banks. Thus far, the “named” plantiffs in the class action suit include Saugusbank, Saugus, Mass.; Eagle Bank, Everett, Mass.; and Collinsville Savings Society, Collinsville, Conn. More bankers associations and many more individual banks are expected to join the list from across the country as the case progresses.

As a result of the TJX data breach, which was first disclosed in mid January, there have been dramatic costs to financial institutions in the effort to protect cardholders. The MBA is filing this lawsuit to protect customer privacy and data security for customer accounts.

<!–PAGEBREAK–>

“The MBA made a decision to file a class action suit because we believe we are in the best position to achieve success for our members and customers,” said Daniel J. Forte, president and CEO of the MBA. “With the possible exception of the banks from California that could also decide to join us, our New England institutions have had the most exposure to this massive data breach. We believe TJX has more stores in our region than anywhere else other than California and, of course, it is headquartered here in Massachusetts. Moreover, we have extensive knowledge and experience with Massachusetts state law, which will likely be an important factor in this litigation.”

Local banks, as well as banks in other regions of the U.S., have been acting to protect customers who had card data compromised after doing business with TJX stores including TJMaxx, Marshalls, Winners, HomeGoods, TKMaxx, AJWright, and HomeSense. Recently, TJX reported that cards and other personal information may have been exposed going all the way back to 2003.

Cases of fraud due to the TJX breach have been reported from all over the world. At the time that the MBA is filing this lawsuit, banks throughout New England continue to receive lists of “hot” cards that have been exposed in the TJX data breach, more than three months after TJX first disclosed it had a problem.

<!–PAGEBREAK–>

Forte said the MBA and the other plaintiffs are not ready to discuss the full extent of the bank losses because the damage is still being done. “Suffice to say,” he said, “we will be seeking to recover damages in the tens of millions of dollars.”

Banks all across the nation re-issued debit cards as a result of the TJX data breach. Preliminary estimates of the costs vary from institution to institution, up to $25 dollars per card. This alone would run into many millions of dollars for banks throughout the country. Moreover, when fraud occurs, banks generally cover the entire fraud, replacing money in customer accounts to protect their customers.

"Protecting consumers is our number one priority" said Lindsey Pinkham, senior vice president of the Connecticut Bankers Association. "However, retail data breaches are getting larger and more frequent and we cannot continue to absorb the costs."

The MBA’s Forte also said he has great confidence this lawsuit will achieve success even though lawsuits brought by other banks as a result of a similar breach by BJ’s Wholesale Club several years ago have achieved mixed results.

<!–PAGEBREAK–>

“There are significant differences between this case and prior data breach lawsuits such as the BJ’s cases in Pennsylvania,” he said. “We think we have an advantage trying the case here in Massachusetts; when the BJ’s cases were argued in Pennsylvania, the plaintiffs did not include an unfair trade practices statutory claim, and Massachusetts law allows these claims.

“In fact,” added Forte, “an unfair trade practice claim was asserted by the FTC and a fine was levied in the BJ’s case. In addition, we will seek to prove that TJX is responsible for negligent misrepresentation. Among other things, the company represented that it was safeguarding and disposing of cardholder data. These representations were not true and showed a lack of reasonable care and were both unfair trade practices and negligent misrepresentation under Massachusetts law. In one of the ongoing BJ’s cases, unlike in Pennsylvania, a motion to dismiss brought by BJ’s was denied in Massachusetts and the case is still proceeding here.

“We believe the litigation ultimately will serve to better protect consumers,” added Forte. “If we’re successful against TJX, the nation’s major retailers will finally wake up to the fact that not protecting consumer data is an unfair trade practice and that investment in data management systems to protect consumers and shield consumers against fraud and identity theft is required.”

<!–PAGEBREAK–>

Representing the New England plaintiffs in the new class action suit is the law firm of Tyler Cooper based in Hartford, Conn., which is also general counsel to the Connecticut Bankers Association. Tyler Cooper has also been working with the MBA and the other associations on the New England Debit Card Task Force.

The Massachusetts Bankers Association represents 207 commercial, savings and co-operative banks and savings and loan institutions in Massachusetts and elsewhere in New England.

The Connecticut Bankers Association represents over 64 financial institutions conducting banking operations in the State of Connecticut and elsewhere in New England.

The Maine Association of Community Banks represents 23 Maine-based financial institutions.