"There's a variety of issues, from the negligence of these companies to protect credit-card information to issues of violations of privacy legislation and other legislation that protect personal information in Canada," said Evatt Merchant a partner at the law firm.

"In terms of corrective action, there would have to be safeguards to make sure this didn't happen again, and damages have to be assessed on a classwide basis, though obviously that is something that is a bit downstream," right now, he said. He added that public response to the lawsuits has been "significant."

McConnell said TJX had no comment on the lawsuit.

TJX said last Wednesday that an "unauthorized intruder" had gained access to its system and may have stolen credit and debit card data belonging to an unspecified number of customers in the U.S., Canada and Puerto Rico, and possibly in the U.K. and Ireland.

The retailer, which owns discount retail chains including TJ Maxx, Marshalls and Bob's Stores, didn't disclose the number of shoppers that may have been affected by the breach, saying that the full extent of the data theft "is not yet known."