Attorney General announces settlement in identity theft case

Montgomery – Today, Attorney General Troy King, together with 40 other State Attorneys General, announced a settlement with the TJX Companies, Inc.  The Assurance of Voluntary Compliance between the parties resolves an investigation concerning TJX’s data security practices and whether they adequately protected customers’ financial information and sufficiently guarded against a massive data breach affecting customer and transaction information for TJ Maxx, HomeGoods, and Marshalls stores that placed thousands of consumers’ personal data at risk, nationwide.  Under the terms of the settlement, Alabama will receive $58,968.30 to aid consumer protection enforcement and efforts to protect consumers’ personally-identifiable information.  TJX cooperated fully in the States’ investigation. 
“Since I became Attorney General, one of my primary missions has been to protect Alabamians against identity theft,” said Attorney General Troy King.  “When we use a debit card or credit card, we are placing our trust in that business.  We expect them to safeguard our personal information to ensure that criminals cannot have access to it.”  General King continued, “Because of today’s settlement, Alabamians can now shop at these businesses more confident that new protections are in place to ensure their personal information is encrypted and more difficult for criminals to access.”
In 2007, after TJX announced that certain persons had obtained unauthorized access to its computer systems enabling them to seize cardholder data and other personally identifiable information, the coalition of Attorneys General conducted an extensive investigation into TJX’s data security policies and procedures in place when the breach occurred.  That investigation uncovered a number of vulnerabilities and flaws in TJX’s data security systems that facilitated the unlawful intrusion and allowed it to last undetected for an unacceptable duration.  Today’s settlement reflects the lessons learned from that data breach and requires TJX to implement an information security program designed to guard against future intrusions or unauthorized disclosures.  The Assurance’s relief, in that regard, is the most comprehensive relief achieved to date following a data breach investigation.

The settlement ensures that TJX will employ a comprehensive “Information Security Program” that assesses internal and external risks to consumers’ personal information, implements the safeguards that will best protect that consumer information, and regularly monitors and tests the efficacy of those safeguards.  TJX also will report regularly to the Attorneys General on the efficacy of its program, after obtaining a third-party assessment of its systems. 
TJX has agreed to pay $9.75 million to the states and to implement and maintain a comprehensive information security program to address weaknesses in TJX’s computer security systems in place at the time of the breach.  Of the $9.75 million settlement, $5.5 million is to be dedicated to data protection and consumer protection efforts by the states, and $1.75 million is to reimburse the costs and fees of the investigation.  The remaining $2.5 million of the settlement will fund a Data Security Trust Fund to be used by the State Attorneys General to advance enforcement efforts and policy development in the field of data security and protecting consumers’ personal information. 
Consumers should monitor their credit card and bank statements and check their credit reports periodically.  Consumers may obtain a free copy of their credit report from each credit bureau every 12 months, available by calling 1-877-322-8228 or on the internet at http://www.annualcreditreport.com.  If a consumer believes that he or she is a victim of identity theft, he or she may report the matter to the Attorney General’s Consumer Protection Division by calling toll-free to 1-800-392-5658. “As Attorney General, I am committed to protecting the people of Alabama, and particularly our most vulnerable citizens who may be preyed upon by identity thieves,“ said Attorney General King. “When we receive evidence that indicates this crime has been committed, we will investigate and prosecute vigorously.“