http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9023778 

By Jaikumar Vijayan
June 06, 2007 
Computerworld

HarborOne Credit Union in Brockton, Mass., has sent The TJX Companies 
Inc. an invoice for $590,000 for what the financial institution says it 
incurred in actual costs and reputational damage as a result of the data 
compromise disclosed by the retailer in January.

The bill was sent to TJX on April 30, but the company so far has not 
responded or commented on it in any fashion, said James Blake, the 
president and CEO of the 100,000-member, $1.4 billion credit union.

"The bill was for both direct operational costs that we incurred 
reissuing new debit cards to our customers, as well as the costs to us 
from a reputational standpoint," he said. According to Blake, the TJX 
breach resulted in HarborOne having to block and reissue about 9,000 
cards at a cost of around $90,000. The remaining $500,000 is what Blake 
believes the breach cost the credit union in terms of brand damage.

"We had to notify customers of the fact that their account was breached. 
There were some questions on their part whether or not we were 
responsible [for the breach] when in fact it was TJX's responsibility," 
Blake said.

Rather that pursue a formal lawsuit against TJX for the amount, 
HarborOne has decided to give TJX a chance to do the "morally" right 
thing he said. "Whether they will is another issue. They have chosen not 
to respond to any of our communications. They have run from the problem 
from the very beginning."

According to Blake, in the last year alone, HarborOne has had to reissue 
debit cards more than 30 times to customers as a result of data breaches 
at various retailers. "You can understand why we are a little upset 
about this," he said.

A spokesperson from TJX did not immediately respond to a request for 
comment.

HarborOne's action comes amid growing pressure from credit unions and 
other financial institutions around the country to get retailers to take 
financial responsibility for data compromises. Credit union associations 
in various states are vigorously lobbying lawmakers to approve bills 
that would require retailers to implement stronger data-security 
measures and to reimburse costs associated with reissuing payment cards 
after a breach.

One such bill is the Plastic Card Security Act that was signed into law 
in Minnesota last month after being actively pushed by the Minnesota 
Credit Union Network. And the California Credit Union League is now 
pushing a bill similar to the one in Minnesota. Other states, including 
Texas and Connecticut, have considered similar proposals recently.

Blake, who is the chairman of the Massachusetts Credit Union League, 
welcomed such proposals but said such measures need to be considered at 
the federal level.


_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com