T.J. Maxx Parent Agrees to Pay States $9.75M in Data Theft Case

The Framingham, Mass.-based parent of T.J. Maxx and Marshall's has reached a deal with 42 states impacted by a massive data theft more than two years ago.

TJX Cos. agreed to pay $9.75 million to states to help enforce consumer protection laws and consumer data, the Chicago Tribune reports.

Included in the settlement is the creation of a $2.5 million trust fund to be used by state attorneys general to enforce and develop policy in the data security field.

At issue was a data breach first disclosed in 2007 that exposed millions of payment card numbers to hackers. Exposure began in July 2005, but wasn't detected until December 2006.

The Miami Herald reports that at least one set of crimes can be linked to the breach. In 2007, Irving Escobar of Miami was sentenced to five years in prison for using stolen credit-card data to buy gift cards at Sam's Club and Wal-Mart, where he and others used the cards to buy $3 million worth of jewelry and electronics.

In the settlement, TJX doesn't admit any wrongdoing.