TJX, the parent company of UK discount retailer TK Maxx, has admitted that the legal and and financial costs from the massive data theft disclosed by the firm in January have cost it $20m (£10m) in the first quarter alone.
Details of 45.6m payment cards were stolen from TJX in the world's biggest ever data theft. The stolen information included card details for an unknown number of UK customers taken from the retailer's computer systems in Watford, Hertfordshire.
In its quarterly filing with the US Securities and Exchange Commission, TJX acknowledged that costs were expected to continue to mount in future quarters. The company added: "We face potential liabilities from customers, banks, payment card companies and governmental entities with respect to the computer intrusion."
The figures have alreaqdy risen since the retailer announced in May that it had taken a $12 m (£6.04m) after-tax charge for the quarter ending 28 April.
TJX says it is facing several "putative class-action lawsuits" filed in a number of US states. These lawsuits are said to represent individuals, financial institutions and others claiming injury and shareholder interest associated with the computer intrusion. Some lawsuits also name card processor Fifth Third Bancorp as a defendant because it handled payment-card transactions for TJX.
The company is also facing a lawsuit from the Massachusetts Bankers Association representing banks pressing to have their losses associated with the data breach covered by TJX.
The papers filed with the US regulator say $20m in costs tied to the data breach was spent on investigating the security lapse, strengthening computer security and communicating with customers about the compromise of sensitive financial data.
In the quarterly filing, TJX reported net sales for the quarter ending April 28 were $4.1bn (£2bn), up from $3.8bn (£1.9bn) in the same quarter a year ago. Profits were down from $163.8m (£82m) a year ago to $162.1m (£81m) in the first quarter of this year.
Last week, TJX was hit with a $590,000 (£295,000) bill by a credit union for costs and reputational damage as a result of an enormous data compromise disclosed by the retailer in January.
Read related storiesROUND-UP: the TK Maxx data theft debacle
Find your next job with computerworld UK jobs