Company: TJX
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000109198-25-000010
Chunk: 49

Company: TJX COMPANIES INC /DE/
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1A
Chunk 49
---
 implementing and maintaining appropriate systems; adopting new technologies (including artificial intelligence or other emerging technologies) appropriately and in a timely manner; and maintaining effective disaster recovery plans for such systems. Our ongoing operations and successful growth are dependent on our doing these things effectively. We also are dependent on the ongoing integrity, security and consistent operation of these systems, including related back-up systems.

As is common in the retail industry, our IT systems, as well as those of our suppliers, service providers and other third parties whose information technology systems we utilize directly or indirectly, are targeted by attempts to access or obtain personal or other sensitive information, attempts at monetary theft and attempts to disrupt business. These attempts include use of malware, ransomware, phishing, vishing, deepfakes, social engineering, denial-of-service attacks, exploitation of system vulnerabilities or misconfigurations, Associate or third-party service provider malfeasance, digital and physical payment card skimmers, account takeovers and other forms of cyber-attacks. These attempts continue to increase in sophistication (including through the use of artificial intelligence), heightening the risk of compromise or disruption. While some of these attempts have resulted in cybersecurity incidents, the unauthorized intrusion into our network discovered late in 2006 is the only such cybersecurity incident to date that has been material to the results of our operations. Our IT systems and those of our suppliers, service providers and other third parties also may be damaged or disrupted, or personal or sensitive information compromised, from a number of other causes, including power outages, system failures, catastrophic events, or Associate or third-party error. Such damage, disruption or compromise could materially impair our ability to operate our business or otherwise result in material impacts on our operating results.

Changes in the business landscape and the increase of remote working by our Associates, service providers and other third parties have the potential to increase the likelihood of system damage or disruption and increase the risk of a cybersecurity compromise. Additionally, there continues to be a heightened risk of cybersecurity incidents as a result of geopolitical events outside of our control. These factors have led to the need for additional mitigation strategies and investments across our IT Security workforce, technologies and processes. 

In addition, the global regulatory environment surrounding information security and privacy is increasingly demanding, and cybersecurity compromises and disruptions in our IT systems could result in regulatory enforcement actions, class actions, contract liability or other forms of material legal liability. Any successful compromise or disruption of our IT systems, or other compromise of the information that we collect or is collected on our behalf from our customers, Associates or other persons