Macrocosmic Technologies

A settlement has been proposed between TJX and the lead plaintiffs for consumers who were affected. Divided into two classes are those whose financial details were exposed and those whose identity information was exposed. If you lost money, you can collect up to two $30 gift certificates, provided you can document the loss, including your wasted time at a princely $10 per hour. If you returned something without a receipt, and gave your driver’s license, you can collect three years of credit monitoring too. Oh, and they’re going to have a sale sometime in 2008 where you can get 15% off.

So, if a company implements shoddy security practices and causes mass card cancellation, as well as untold identity theft and consumer fraud, instead of quietly burying it, you turn it into a marketing event. Got it.

I have an $80 charge from 11/05 against a card that was used at TJX during the period that thieves had open access to the credit card details. Needless to say, FCRA’s 60 day dispute period is long gone, so a lawsuit against TJX may be my only reasonable recourse. Treble damages, court fees, time lost, and identity monitoring and theft protection come up to a tidy sum. Even if I accepted the class action settlement, I’d get, at most, $60 in gift certificates for my lost $80.

In this Information Week article, it is reported that TJ Maxx, poster child for the mother of all data disclosures, is being sued by banks. If you remember, they let loose some 45 million credit and debit cards. Figuring $25 cost for each exposed card incurred by a bank to void and reissue the card in question, you come up with somewhere north of a billion dollars as the cost of cleanup. Banks are not primarily in the “spending money out of the goodness of our hearts” business, and will want to collect on their costs, thus coming after the responsible party. Enter the class action suit, covering some 300 banks.

Prediction: This is just the first wave in this type of lawsuit. No longer will admonishment by the FTC or a “mea culpa” sent to customers be the biggest driver behind keeping data on lockdown. Now, private recovery costs will be the biggest stick in the game.

If you live in Illinois, it may soon become illegal to own a magnetic stripe reader, if this bill is introduced into law, as reported by Bruce Schneier

Clearly, if we outlaw n, we won’t have to think about the fallout of n because no one will have n. It worked for alcohol, didn’t it?