The Securities and Exchange Commission (SEC) announced it has decided not to recommend any enforcement action against Target Corporation for the cyberattack in 2013 which led to the data breach of millions of its customers' private information. The attack was one of the largest ever against a U.S. company.The SEC was one of a number of government agencies that investigated Target after the data breach. Target filed its quarterly results document with the agency for investors to see, saying the investigation ended during the recent three-month period from May to July.
The SEC's decision removes one potential liability for Target over the data breach, although the retailer continues to be under investigation from state attorneys general and private litigators over the episode and may face costs from penalties or settlements tied to them.
In November 2013, cyber thieves accessed point-of-sale terminals in hundreds of Target stores and, for three weeks before being caught, were able to download the credit card number and names of about 40 million people who made purchases. As a result, millions of people canceled credit cards or asked issuers for new ones. The retailer saw a brief, but significant dip in sales during the 2013 holidays.
Target said it now estimates paying $264 million in breach-related costs, ranging from litigation claims to the expenses it experienced for fixing systems and sending out information at the time of the attack. That's up from its previous estimate of $252 million. About $90 million has been covered by Target's insurers.
While it faced hundreds of lawsuits in the months after the breach, they were consolidated into three main tracks of litigation. One track, a group of lawsuits in which consumers are plaintiffs, was settled for $10 million earlier this year.
On another track are four claims brought by each of the four big credit card companies on behalf of banks and other institutions that issue their respective cards. Last week, Target and Visa Inc. agreed to settle the Visa-related claim for $67 million. "With respect to the three major payment card networks other than Visa, we think it is probable that our disputes would lead to settlement negotiations," Target said in Tuesday's filing.
Earlier this year, a settlement that Target had negotiated with MasterCard Inc. for $19 million fell apart when it was rejected by issuers of MasterCard. And a group of attorneys has filed a lawsuit seeking class action status on behalf of card issuers that may result in a legal process apart from the negotiations with the credit card companies. A hearing on that suit is scheduled for next month in a Minneapolis court.
Another lawsuit brought in Canada that was dismissed is being appealed.