Off-price retailer The TJX Companies Inc has agreed to pay $9.75m to 41 states after hackers breached the company's computer system more than two years ago and stole customer data.