State seal of the State of Vermont
The State of Vermont
The Office of the Attorney General




Home » Press Releases

Press Releases

Attorney General Settles With The TJX Companies Over Massive Data Breach

CONTACT: Sarah London, Assistant Attorney General, (802) 828-5507

June 23, 2009 - TJX Companies, Inc. has agreed to correct its handling of consumer data and to pay Vermont $272,600 for flaws in the company’s data security. The company experienced a massive security breach from 2005 to 2007 in which intruders are believed to have gained access to hundreds of millions of credit and debit cards. “Identity theft is the fastest growing crime in this country. Companies like TJX can’t drop the ball,” said Attorney General William H. Sorrell.

TJX owns the discount clothing and homeware stores of TJ Maxx, Marshalls, HomeGoods, AJ Wright, and Bob’s Stores. The company has previously settled charges by the Federal Trade Commission related to the security breach, including charges that it created an unnecessary risk to personal information by storing and transmitting credit card numbers and other sensitive data in clear text without encryption, and that it failed to use readily available security measures to limit access among its computers and the Internet.

The settlement announced today by Attorney General Sorrell, together with 40 other State Attorneys General, requires the company to pay the states $9.75 million and implement an information security program to protect consumer data. The settlement requires TJX to update its wireless security system, to not store credit card or debit card data any longer than necessary, and to use firewalls, access controls, and proper passwords for those portions of its networks that store, process, and transmit personal information.

  Website consulting provided by The National Association of Attorneys General.