Evan Schuman's StorefrontBacktalk

The Rhode Island Attorney General?s office is launching a formal investigation of TJX?s data breach, including what caused it, why it wasn?t detected more quickly and why the announcement of it was delayed, the AG?s office announced on Monday.

The investigation?technically, a Civil Investigative Demand (CID) on the authority of both Rhode Island?s Deceptive Trade Practices Act and its Identity Theft Protection Act of 2005?is expected to officially begin with its first meeting with TJX officials on Feb. 14 at the Attorney General?s office in Providence, said Edmund Murray Jr., a special assistant attorney general who is in charge of the probe.

Both Murray and the department?s public information officer, Michael Healey, said the next stages will be dictated by the facts uncovered during the probe. Typically, though, state AG offices usually seek compensation for state residents who are trying to defend themselves against identity theft, including credit report costs and possibly money to pay for help processing such claims.

But if conduct established in the probe is severe enough, more substantial options?including a civil lawsuit and possibly criminal charges?could be considered. One key concern, Murray said, is the month-long delay after the breach?s discovery but before it was announced. Rhode Island law requires that impacted consumers shall be notified ?immediately.? Unfortunately, Murray said, the statute does not define ?immediately.? Although no announcements have been made, the national nature of TJX?s chain makes it likely that other states may want to conduct their own probes.