TJX data breach costs: $17 million and growing

TJX took another cash hit for losing 45.7 million debit and credit card numbers.

The retailer, which runs TJ Maxx, Marshalls and other off-price stores, reported a charge of $12 million, or 3 cents a share, in its first quarter. That sum coupled with a $5 million charge in the previous quarter brings the running tab to $17 million. TJX disclosed the damage from its data breach in March.

Meanwhile, TJX (latest news and posts) said it estimates that it will take charge in the second quarter roughly equivalent to the first quarter tally. That addition would bring the TJX tab to $29 million or so through June. TJX said it can't project costs beyond the second quarter. Total loss estimates for TJX are largely guesstimates, but Forrester indicates the tab could become quite expensive.

The TJX data breach was most likely due to an insecure wireless network. George Ou details the breach and outlines how other retailers still aren't securing their Wi-Fi networks.

TJX said its data breach costs were due to "costs incurred to investigate and contain the intrusion, enhance computer security and systems, and communicate with customers, as well as technical, legal, and other fees."

Here's how TJX portrayed the breach in its earnings statement:

On January 17, 2007, TJX announced that it had suffered an unauthorized intrusion(s) into portions of its computer systems that process and store information related to customer transactions. In the first quarter of fiscal 2008, the Company recorded an after-tax charge of approximately $12 million, or $.03 per share, for costs incurred during the first quarter, which includes costs incurred to investigate and contain the intrusion, enhance computer security and systems, and communicate with customers, as well as technical, legal, and other fees.

In the second quarter, the Company expects to continue to incur these types of costs related to the intrusion(s), which the Company estimates will total $.02 - $.03 per share. Beyond these costs, TJX does not yet have enough information to reasonably estimate the losses it may incur arising from this intrusion, including exposure to payment card companies and banks, exposure in various legal proceedings that are pending or may arise, and related fees and expenses, and other potential liabilities and other costs and expenses. The Company will record known losses when they become both probable and reasonably estimable.

The financial damage thus far for TJX has been minimal. While the data breach charge hurt, TJX earnings are roughly flat. The company reported same store sales growth of 2 percent from a year ago and net income was 34 cents a share, including the charge for the data breach. Excluding that charge, TJX reported earnings of 37 cents a share, a penny less than Thomson Financial estimates. Sales were 4.1 billion, up 6 percent from a year ago.

TJX said its sales were "slightly below plan" due to cold and wet weather in March and April. TJX's second quarter outlook was on par with Wall Street expectations.

Add it up and investors are giving TJX a pass on the data breach. Losing 45.7 million records is just a financial charge to be excluded when evaluating the company.