Skip to main content
Iowa Attorney General
Main Content

June 24, 2009

Iowa Joins Multi-State Settlement with the TJX Companies, Inc., Over Massive Data Breach

Iowa to receive $28,000 to help ensure protection of personal data.

TJX Companies, Inc., the parent company of T.J. Maxx and Marshalls and other retail stores, has reached a settlement with Iowa and a total of 41 states concerning TJX’s security practices and a massive data breach that exposed millions of credit and debit cards from 2005 to 2007.

TJX agreed to pay $9.75 million to the 41 states, including $28,000 to Iowa. TJX also will implement a comprehensive information security program to safeguard consumers’ data. The company will regularly monitor and test the effectiveness of the safeguards and report regularly to the state Attorneys General on the program.

TJX has said the data breach, disclosed in early 2007, involved about 47 million credit and debit cards. It admitted no wrongdoing under the settlement. Earlier class-action cases involved payments of millions of dollars to card issuers who had to reissue credit cards, and to consumers.

TJX’s payment of $9.75 million to the 41 states includes $5.5 million to be used by the states for data protection and consumer protection efforts, $1.75 million for the costs of the states’ investigation, and $2.5 million to fund a Data Security Trust Fund to advance the states’ enforcement efforts and policies in the realm of data security and protecting consumers’ personal information. Iowa’s share of $28,528.50 will be used for consumer litigation and education.

- 30 -

« Back

Quick Exit
© 2022 State of Iowa Office of the Attorney General. All rights reserved.