Montana Joins $18.5M Settlement with Target Corporation over 2013 Data Breach

Attorney General Tim Fox announced today that Montana has joined with 46 other states and the District of Columbia in an $18.5 million settlement with the Target Corporation to resolve the states’ investigation into the retail company’s 2013 data breach. The settlement represents to largest multistate data breach settlement achieved to date.

The states’ investigation, led by Connecticut and Illinois, found that, on or about November 12, 2013, cyber attackers accessed Target’s gateway server through credentials stolen from a third-party vendor. The credentials were then used to exploit weaknesses in Target’s system, which allowed the attackers to access a customer service database; to install malware on the system and to capture data, including consumer data comprised of full names, telephone numbers, email addresses and mailing addresses; payment card numbers, expiration dates and CVV1 codes; and encrypted debit PINs.

The breach affected more than 41 million customer payment card accounts and contact information for more than 60 million customers.  It’s estimated that between 150,000 and 210,000 Montana consumers may have been affected by the data breach.

“Target’s failure to safeguard customer information resulted in exposure to identity theft for thousands of Montanans during the holiday shopping season four years ago,” Attorney General Tim Fox said.  “Today’s settlement is a step in the right direction toward restoring the confidence Montanans should expect when they shop, especially at major retailers, that their payment card information and personal data is safe.”

In addition to the monetary payment to the states, the settlement agreement requires Target to develop, implement and maintain a comprehensive information security program and to employ an executive or officer who is responsible for executing the plan. The company is required to hire an independent, qualified third-party to conduct a comprehensive security assessment.

The settlement further requires Target to maintain and support software on its network; to maintain appropriate encryption policies, particularly as pertains to cardholder and personal information data; to segment its cardholder data environment from the rest of its computer network; and to undertake steps to control access to its network, including implementing password rotation policies and two-factor authentication for certain accounts.

Montana will receive nearly $178,600 from the settlement.

In addition to Montana, and led by the Connecticut and Illinois, other states participating in this settlement include Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington and West Virginia and the District of Columbia.

More information is available here.

X