I don’t see in your post any evidence that the TJX breach was not as bad as we’ve been told. Do you have information that fewer than 45 million cards were compromised?

As I wrote in my response to that post, I disagree that the FTC or issuers overreacted. I also think its important that we distinguish between known effects, actual effects, and potential effects of the breach. The DOJ indictment gave a dollar figure that could be traced to the defendant, but that doesn’t imply that the figure accounts for all loss to consumers from the theft. More importantly, a mere comparison of settlement costs to DOJ indictment numbers ignores the probability that those numbers aren’t any higher precisely for the reason that issuers were prompt and diligent in replacing credit cards.