Hacker Costs Keep Growing

Millions in expenses for Mass. companies follow data breaches

By Todd Wallack, Globe Staff  |  August 22, 2009

The massive credit card data thefts linked to Miami hacker Albert Gonzalez have cost New England companies several hundred million dollars.

Gonzalez and several unnamed accomplices were accused this week by the Department of Justice of conspiring to steal 130 million credit cards - the largest data breach reported - after penetrating the computer networks of major retailers and a credit card processing company, Heartland Payment Systems.

Gonzalez was previously charged with orchestrating the heist of more than 40 million credit cards from nine retailers, including discounter BJ’s Wholesale Club of Natick and Framingham-based TJX Cos., which operates TJMaxx and Marshalls stores.

Those companies in turn say they have been forced to spend millions of dollars to contend with the damage.

TJX said it has spent $132 million on expenses related to the breaches, including the cost to investigate and contain the intrusion and to handle lawsuits and other legal claims. It has set aside another $39.5 million to handle further claims. Spokeswoman Sherry Lang said TJX has also spent millions of dollars beefing up its computer security.

The retailer has faced a raft of litigation initiated by banks, individuals, and government agencies accusing TJX of lax security that allowed hackers to penetrate its network and obtain millions of card numbers. In June, for instance, TJX struck a $10 million deal to settle a lawsuit brought by 41 states alleging the company did not do enough to protect customers. And it spent $65 million to settle suits by banks that issued Visa and Mastercard credit cards.

Meanwhile, BJ’s set aside $13 million between 2004 and 2007 to handle claims for fraudulent credit and debit card charges and the cost of replacing cards, offering credit monitoring, and related expenses. But it also cautioned that it faced a number of outstanding legal claims. BJ’s officials did not respond to requests for comment.


Continue Reading

Related articles by Zemanta

• Is Heartland/WorldPay Suspect in Custody? (information-security-resources.com)


• Data-sniffing attack costs Heartland $12.6m (theregister.co.uk)


• Heartland reveals cost of data breach (vnunet.com)


• Data Sniffing Costs Heartland Bigtime (pindebit.blogspot.com)


• TJ Maxx Parent Company Settles With 41 States Over Credit Card Theft Fallout (shoppingblog.com)


• 4 Years After TJX Hack, Payment Industry Sets Security Standards (wired.com)