Surprised that TJX customers have returned to TJMaxx and Marshall's, waving their credit cards and freely giving cashiers their zip codes and phone numbers? You shouldn't be. People have short memory spans and, frankly, don't care about what lawyers will call "prior bad act" so long as they get the services they want at a price they can afford. Sure, TJX allowed the compromise of nearly 100 million credit card numbers, which caused a great deal of confusion and trouble for accountholders. Yet, TJX customers apparently assume things have been fixed and it's safe to return to the stores.
The Ponemon Institute reports the cost of a security breach such as the one suffered by TJX to be $197 per affected record. At that cost, TXJ should be paying out nearly $200 million. But that's supposed to be the remediation costs, not necessarily the actual losses caused by decrease in business. Reputation was always supposed to be the biggest damage, but the TJX experience is disproving that.
Source: Baseline, http://blog.baselinemag.com