Analysts: TJX case may cost over $1b

["Richard M. Smith" <rms () computerbytesman com>]

http://www.boston.com/business/personalfinance/articles/2007/04/12/analysts_
tjx_case_may_cost_over_1b/

Analysts: TJX case may cost over $1b
Insurance, tax credits could trim expenses for Framingham firm
By Ross Kerber, Globe Staff  |  April 12, 2007

If the loss of millions of customer credit- and debit-card records from TJX
Cos. plays out like previous data-breach cases, the final cost of the theft
could add up to more than $1 billion, some technology analysts say.

The exact cost to TJX itself is unclear and may be lower. Insurance and tax
credits may offset the Framingham retailer's expenses, which could be spread
over several years. Banks that issue the credit cards may also have to pick
up part of the costs.

Regardless, the liability would be among the highest associated with lost or
stolen data, say analysts. They arrived at their estimates by comparing the
cost of breaches at other companies in areas such as technology upgrades,
contacting customers, reissuing cards, and lost customers.

Because TJX's breach was so extensive, they say, regulators and business
partners will be looking for hefty penalties. "When you hit a million or
more records, then you get much more scrutiny," said Jon Oltsik, senior
analyst for Milford consulting company Enterprise Strategy Group, who is
among those who estimates that the TJX breach could cost more than $1
billion.

TJX, which operates stores such as TJ Maxx, Marshalls, and HomeGoods, has
said it spent $5 million through the end of January on costs such as
technical and legal fees and customer communications related to the breach.
The company believes that hackers tapped into its computer system and
compromised more than 45 million customer records going back as far as 2003,
the largest data breach to date.

In a recent securities filing, TJX said it may incur unspecified losses due
to claims by banks, customers, and shareholders, and from costs like
technical and legal expenses, all of which "could be material to our results
of operation and financial condition."

TJX spokeswoman Sherry Lang called the $1 billion cost estimates "pure
speculation by people who are outside the company." She said it is hard to
compare the cost of TJX's breach with previous cases since every example has
"many variables and no two situations are the same, and no two companies are
the same."

So far, investors and Wall Street analysts haven't reacted strongly. TJX's
shares closed at $27.82 yesterday, compared to $29.85 on Jan. 16 the day
before TJX disclosed the matter. One reason is that most investors don't
expect the final costs to be so significant.

...

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.