Very simply, the issue was that T.J. Maxx, the parent company in the United States, took a business decision not to move to the industry-mandated higher level of encryption for its transmission of personal information around the use of credit cards because it didn't think it was a huge risk. Well, it was a huge risk, and I think the bottom line was it cost them $35 million in redress, particularly to banks.
On November 18th, 2010. See this statement in context.