[Dataloss] follow-up: Mass. credit union bills TJX $590k for breach-related costs

[security curmudgeon]

---------- Forwarded message ----------
From: InfoSec News <alerts at infosecnews.org>

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9023778

By Jaikumar Vijayan
June 06, 2007
Computerworld

HarborOne Credit Union in Brockton, Mass., has sent The TJX Companies Inc. 
an invoice for $590,000 for what the financial institution says it 
incurred in actual costs and reputational damage as a result of the data 
compromise disclosed by the retailer in January.

The bill was sent to TJX on April 30, but the company so far has not 
responded or commented on it in any fashion, said James Blake, the 
president and CEO of the 100,000-member, $1.4 billion credit union.

"The bill was for both direct operational costs that we incurred reissuing 
new debit cards to our customers, as well as the costs to us from a 
reputational standpoint," he said. According to Blake, the TJX breach 
resulted in HarborOne having to block and reissue about 9,000 cards at a 
cost of around $90,000. The remaining $500,000 is what Blake believes the 
breach cost the credit union in terms of brand damage.

"We had to notify customers of the fact that their account was breached. 
There were some questions on their part whether or not we were responsible 
[for the breach] when in fact it was TJX's responsibility," Blake said.

[..]