TJX, the parent firm of UK discount retailer TK Maxx, has been hit with a $590,000 (£295,000) bill by a credit union for costs and reputational damage as a result of an enormous data compromise disclosed by the retailer in January.
TJX suffered a massive data theft when 45.6m credit and debit card numbers were stolen from one of its systems over a period of more than 18 months.
The US-based HarborOne credit union sent the bill to TJX on April 30, but the retailer so far has not responded or commented on it in any fashion, said James Blake, the president and CEO of the 100,000-member credit union.
"The bill was for both direct operational costs that we incurred reissuing new debit cards to our customers, as well as the costs to us from a reputational standpoint," he said.
According to Blake, the TJX breach resulted in HarborOne having to block and reissue about 9,000 cards at a cost of around $90,000. The remaining $500,000 is what Blake believes the breach cost the credit union in terms of brand damage.
"We had to notify customers of the fact that their account was breached. There were some questions on their part whether or not we were responsible [for the breach] when in fact it was TJX's responsibility," Blake said.
Rather than pursue a formal lawsuit against TJX for the amount, HarborOne has decided to give TJX a chance to do the "morally" right thing he said. "Whether they will is another issue. They have chosen not to respond to any of our communications. They have run from the problem from the very beginning."
According to Blake, in the last year alone, HarborOne has had to reissue debit cards more than 30 times to customers as a result of data breaches at various retailers. "You can understand why we are a little upset about this," he said.
A spokesperson from TJX did not immediately respond to a request for comment.
HarborOne has become the most recent financial institution to demand compensation from TJX. In April, a coalition of banks, called the Massachusetts Bankers Association (MBA), issued a class action lawsuit against the retailer.
HarborOne's action comes amid growing pressure from credit unions and other financial institutions around the US and Canada to get retailers to take financial responsibility for data compromises. Credit union associations in various states are vigorously lobbying lawmakers to approve bills that would require retailers to implement stronger data-security measures and to reimburse costs associated with reissuing payment cards after a breach.
One such bill is the Plastic Card Security Act that was signed into law in Minnesota last month after being actively pushed by the Minnesota Credit Union Network. And the California Credit Union League is now pushing a bill similar to the one in Minnesota. Other states, including Texas and Connecticut, have considered similar proposals recently.
Blake, who is the chairman of the Massachusetts Credit Union League, welcomed such proposals but said such measures need to be considered at the federal level.