In what appears to be the closing act of the saga that is the
Target data breach, on May 23 the retailer announced it had reached
a settlement agreement with a coalition of 47 states' attorneys
general. Pursuant to the settlement, Target will pay $18.5 million
to the states in rough proportion to their population (California
will receive the largest distribution, with $1.4 million). The
settlement represents the largest multi-state data breach
settlement to date, although, unfortunately, it is almost certainly
only a matter of time before it is eclipsed.
Target discovered the breach during the 2013 holiday shopping
season. Investigations into the breach revealed that hackers gained
access to a database containing customer payment card information
— including customer names, card numbers, expiration dates,
security numbers and debit card PINs — by breaching one of
Target's third-party vendors. The breach impacted the payment
card information for over 40 million
