BOSTON – Discount retailer TJX Cos. could pay as much as $24 million in a settlement reached Wednesday with MasterCard Inc. over a massive breach that exposed tens of millions of payment card numbers to hackers.

The pact came as a group that tracks U.S. data breaches reported the number of cases in the first three months of this year was more than double the total in last year’s first quarter.

The TJX agreement, which follows a similar $40.9 million pact in November with Visa Inc., hinges on banks that issue MasterCards agreeing to waive rights to sue TJX in exchange for being paid for breach-related costs.

Issuers of at least 90 percent of the MasterCard accounts identified as possibly being compromised in the breach must approve the agreement by May 2 for the settlement to take effect, Purchase, N.Y.-based MasterCard and Framingham, Mass.-based TJX said in separate news releases.

TJX disclosed the data heist in January 2007. The owner of more than 2,500 stores, including T.J. Maxx and Marshalls, said a couple of months later that at least 45.7 million credit and debit cards were exposed to possible fraud in a computer systems breach that began in July 2005. The breach wasn’t detected until December 2006.