advertisement
advertisement


TJX’s Settlement: Marketing Chutzpa At Its Best

Written by Evan Schuman
September 22nd, 2007

Only TJX could take a lawsuit settlement from the worst retail data breach ever and try and turn it into an upsell situation.

TJX's multi-part settlement of all of the consumer lawsuits against it for its massive data breach is a fascinating denouement to the TJX saga. What makes this latest twist so delicious is that TJX has played this debacle the way a retailer should, assuming the retailer is Niccolo Machiavelli.

When admitting to a massive databreach impacting some 46 million of your customers and when also conceding by implication that much of it was your fault given inadequate security measures, most companies would be chagrined, embarrassed and perhaps even a little bit ashamed. But not our heros.

This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.


advertisement

6 Comments | Read TJX’s Settlement: Marketing Chutzpa At Its Best

  1. Robert Amster Says:

    I have to ask: did the customers whose security was breached agree to those terms or did the attorneys general in charge of the cases?

    Most consumers are not stupid enough to agree to such a settlement. A consumer would know that he/she is being duped into coming back into the store to spend money in it.

    However, if the settlement was accepted by the injured parties, you have to give TJX credit for their chutzpah. It appears that it worked.

  2. Evan Schuman Says:

    Editor’s Note: The answer is technically “neither.” First, this case is entirely distinct from the state Attorney General cases that are still pending. (Actually, those cases are consolidated under Massachusetts, so it’s functioning as one action.) The state AGs have no direct involvement in this case.
    This deal was agreed to by the attorneys representing certain users and TJX. I am strongly assuming that most of the consumers involved were briefed and signed off. Of course, there are millions of consumers involved so it would only be the named consumers who would have had any say.

  3. Ray Dobbs Says:

    You’ll see some very similar “marketing” tactics from VerizonWireless in their “Campbell Class Action Settlement” from 2006

    http://www.verizonwireless.com/b2c/globalText?contentType=Legal%20Notice&textId=87 .

    Multiple options offered to the Class. Most involve insiginificant discounts on very high-margin accessories.

    And, on top of it all, their method of submission for these settlement options was so complex, that you ended up spending $50 worth of time to receive a $10 “payoff”.

    Evan – thanks for shining a big light on the games people play. Never ceases to amaze.

  4. Eric Offenberg Says:

    I never really considered how TJX actually timed every communication to work to their advantge.

    My guess is that the gift cards will be sent to customers to arrive 11/19-11/21, right before Black Friday.

    Then a settlement will be announced with the state AGs will be announced Christmas Eve.

  5. Evan Schuman Says:

    Editor’s Note: Good thought, Eric, although I doubt they’ll have the settlement improved in time for Nov. 19. Other than that, yes, that is likely what they would have tried to do.
    As for the AG settlement, that will now prove interesting. All that the AGs will actively pursuing–the last time I checked–was credit card monitoring reimbursement. Given this agreement, they might wait to see if the settlement is approved. If it is, they might just echo it.

  6. Jason Merrick Says:

    It is significant that TJX is once again being secretive about the steps it is taking to secure its network since it was secretive about the breach itself. The real challenge with network security is that every new technology brings both benefits and risks and forethought must be given to those risks preferably before the technology is implemented. While there is some discussion about whether or not the breach at this retailer was wireless, and it is our opinion that it was, it is important to think about network security strategy in a global way instead of a siloed one and wireless security must be part of that strategy, whether or not you have deployed wireless. With the proliferation of wireless, wireless security is a must have not an afterthought, and it need not be an expensive and daunting task to implement.

Leave a Reply

Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.

Weekly, Monthly Newsletters

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly report, with urgent bulletins as news merits—along with our monthlies on Mobile, Security, In-Store, E-Commerce and CRM.
advertisement

Most Recent Comments

"Careless" Systems Integrators Now Directly Under PCI DSS

This exact issue has been bothering me for years, and I was JUST talking about it with someone only yesterday. This may well be my favorite article, mostly because I'm biased and have hated this particular problem forever. Read more...
Good article, but how does this have anything to do with the DSS? Read more...
Actually, the QIR program has a lot to do with the DSS (or PCI). Since merchants rely on their reseller or integrator to implement their PA-DSS validated application, these resellers and system integrators play a critical role in merchants achieving and maintaining PCI compliance. As far as I can tell, the QIR program is designed to help merchants stay compliant by making sure their payment applications are installed according to the PA-DSS Implementation Guide, for example ensuring default passwords are changed (and protected), that the data encryption keys are properly set and secured, that the merchant's data retention policy is set, that no sensitive cardholder data are stored, and often that a firewall is in place and properly configured. Read more...
Although this is a great move forward in pushing the issue of highly trained people, it is also a good marketing ploy for the council. It begs the question: How much do they stand to make? The problem for this is that for people (like myself) that are just starting out their own business venture, PCI has typically charged a premium for their training and certifications. This change will likely force those of us with less capital to spin into the abyss. I have more than 15 years in the security and compliance fields with heavy hitter certs like CISSP, CRISC, and Sec+. There should not be a guide but a free test or a pre-requisite of either the PCI cert OR other heavy hitter certs. I just don't want the good guys in small places to get flushed out. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.