Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

Target to Pay States $18.5 Million Over 2013 Data Breach

U.S. retail giant Target has entered a settlement with the Attorneys General of 47 states and it has agreed to pay $18.5 million over the massive data breach suffered by the company in 2013.

U.S. retail giant Target has entered a settlement with the Attorneys General of 47 states and it has agreed to pay $18.5 million over the massive data breach suffered by the company in 2013.

The total amount will be divided among the Attorneys General, with Illinois and Connecticut, which led the investigation, in charge of determining how much should be paid to each state. Illinois will receive $1.2 million, Connecticut just over $1 million, and the New York Attorney General reported that his state will receive more than $635,000 from the settlement.Target settlement

The money can be used by states for various purposes, including to cover attorney fees and investigation costs, or it can be placed in the consumer protection enforcement fund.

As part of the settlement, the retailer has also agreed to implement an information security program. Target has promised to take both administrative and technical measures to ensure that its systems and customer data are secured properly.

The technical measures include network segmentation, access control and management, file integrity monitoring, whitelisting, logging, change control, and the adoption of payment card security technologies. The company is also required to hire a third-party to conduct a cyber security assessment.

Since cybercriminals gained access to its systems via an HVAC contractor, Target has promised to audit vendors to ensure that they comply with its information security program.

Roughly 40 million payment cards were compromised in the 2013 data breach, and tens of millions of consumers had their personal data stolen. Following the incident, the company promised to invest $100 million to accelerate migration to EMV cards.

Target reported last year that the breach had cost it $290 million. That included $67 million paid to Visa card issuers, over $20 million to banks and credit unions, roughly $19 million to MasterCard card issuers, and $10 million to affected consumers.

Target’s settlement with states comes just weeks after Home Depot agreed to pay $25 million to the financial institutions affected by a data breach suffered by the retailer in 2014, when cybercriminals managed to steal email addresses and payment card data belonging to more than 50 million customers.

Advertisement. Scroll to continue reading.

Related Reading: U.S. Authorities Reach Settlement With Adobe Over 2013 Breach

Related Reading: Western Union Pays $586 Million to Settle Fraud Charges

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...