TJX offers $40.9 million breach settlement

TJX Cos. Inc. is offering to pay Visa card issuers $40.9 million to compensate for costs connected to the massive data security breach the retailer first disclosed in January. The move, designed to save the company many millions of dollars in lawsuit damages, comes on the heels of a decision in U.S. District Court in Boston to reject the class-action status banking associations sought in their lawsuits against the company.

In a statement released Friday, Framingham, Mass.-based TJX said it will pay up to $40.9 million to fund the "alternative recovery" program, which requires a certain level of participation by issuers for the offer to be finalized. Visa Inc. is supporting the proposal.

"We believe issuers will benefit greatly by participating in this program because it offers immediate recovery on their data breach claims," Ellen Richey, head of global risk management for Visa Inc., said in a statement. "This agreement demonstrates the importance of retailers and the payment card industry working together to protect cardholder data. Additionally, it's clear the impact of a data compromise harms all payment system stakeholders -- merchants, banks and consumers alike. We hope one outcome of this resolution is recognition that a greater investment in security is good business."

All U.S. Visa card issuers who were forced to issue new cards and address fraudulent activity are eligible for financial compensation this calendar year if they participate in the program. Banks have until Dec. 19 to decide whether to accept the offer.