The Wall Street Journal (subscription required) reports that the FBI is looking into a potential computer-security breach that resulted in the theft of tens of millions of dollars from Citibank by computer hackers.

These hackers appear to be linked to a Russian cyber gang who targeted Citigroup's (C) Citibank subsidiary, including its North American retail bank and other businesses. This attack was detected over the summer, but there is a chance that it could have happened as much as a year earlier.

TJX Cos. (NYSE:TJX) has admitted that hackers stole 45.7 million credit and debit cards from its computer network over an 18-month period in what one analyst described as the biggest theft of its kind ever, according to the Associated Press.

The owner of TJ Maxx and Marshall's, which first disclosed the thefts more than two months ago, outlined the extent of the problem in a filing with the Securities & Exchange Commission, the AP said, adding that 45,000 customers who returned merchandise also had their personal data stolen.

This is a public relations disaster.

The company should have disclosed to customers as much information as it could in January without jeopardizing any investigations. People would've grumbled, but they would have understood the situation because computer thefts are a fact of modern life.

Since the company waited to disclose the extent of the problem, TJX made customers even angrier than they would have been otherwise. Winning them back won't be easy.

It's no wonder that the company is being sued by invidiudals and investigated by the Federal Trade Commission.

The lesson here for companies is that it's a bad idea to bury bad news in an SEC filing. That information is easily accessible and somebody will read it eventually.