TJX Settling Out?

According to this article from Computer World TJX has proposed to pay $40.9 million to banks that issued Visa cards potentially affected by TJX's massive data breach if the affected banks agree not to pursue litigation against TJX. The article describes TJX's offer a move which could save "tens of millions of dollars in lawsuit damages." Actually, that's understating things quite a bit. In paragraph 96 of the fifth amended complaint in the ongoing litigation regarding the TJX breach (case number 1:07-cv-10162), a bankers association seeking class certification alleged that "The cancellation and reissuance of cards resulted in damages and losses to Plaintiff Banks and members of the proposed Class of up to $25 per card." As the first paragraph of that same complaint alleged that "approximately 100 million credit cards were compromised because of TJX's acts and omissions," it seems that there were potentially up to 2.5 billion (25 dollars/card * 100 million cards) dollars in damages. Even assuming that the $25 per card cited as the maximum in the lawsuit is unrepresentative, and the real cost is lower (e.g., the 10 dollars/card quoted in this posting), the cost of canceling and reissuing almost 100 million cards is certainly greater than the $40.9 million offered by TJX. Of course, there's no guarantee that the banks would win if they did pursue litigation. However, if TJX ends up eliminating its litigation risks from banks who had to reissue cards for only $40.9 million, then TJX would dodge a very big bullet at only a (relatively) low cost.