Evan Schuman's StorefrontBacktalk

TJX reported Tuesday that, in the three months leading up to April 28, it spent another $12 million dealing with the data breach the company announced in January. That’s on top of $5 million TJX said it spend in the immediately previous three months to deal with the breach.

These figures, while not trivial, are dramatically below some industry projections of billion-plus-dollar losses. Customer loyalty?and apathy?is proving to be the key difference.

A TJX statement said the money spent “includes costs incurred to investigate and contain the intrusion, enhance computer security and systems, and communicate with customers, as well as technical, legal, and other fees.”

The latest quarterly cost comes to 3 cents per share. TJX advised investors that it expects to have to spend even more in the current quarter, perhaps another 2 cents to 3 cents per share, which would come to about another $8 million to $12 million. If that holds, it would total about $25 million to $29 million for that nine month period.

When the $16 billion chain first disclosed in January the massive data breach–where the card information of some 46 million consumers fell into unauthorized hands–it was apparently not in compliance with retail industry PCI standards, especially concerning a wireless store network where the intruders reportedly first gained access.

Although some in the industry have projected huge?more than $1 billion?costs for TJX in connection with the breach, a huge portion of those assumptions are based on guesses that TJX customers would sharply reduce purchases and that huge amounts of money would be spent contacting every potential victim. Thus far, both assumptions are not panning out.

Still, the owner of Marshalls, T.J. Maxx, HomeGoods, Bob?s Stores and A.J. Wright was careful to not predict how much they?ll eventually have to pay, especially with quite a few class-action lawsuits (from both consumers and banks) pending, as well as state Attorney General investigations and other government probes.

?Beyond these costs, TJX does not yet have enough information to reasonably estimate the losses it may incur arising from this intrusion, including exposure to payment card companies and banks, exposure in various legal proceedings that are pending or may arise, and related fees and expenses, and other potential liabilities and other costs and expenses,? it said in a statement issued Tuesday. The Company will record known losses when they become both probable and reasonably estimable.?