Target Corp. agrees to pay $39.4M settlement with banks and MasterCard issuers over 2013 data breach, after settling with Visa issuers for up to $67M last month
Context & Ripple Effects
This closes the last open front in Target's fight with the card networks. In April it agreed to pay issuing banks $19 million via MasterCard, but the biggest issuers rejected that offer in June as too small — leverage that produced a far richer deal on the Visa side, where sources put Target's payout at up to $67 million. Today's $39.4 million agreement is effectively the re-priced MasterCard track.
The sums sit alongside Target's own disclosure that the breach cost it $162 million across 2013-14, plus a $10 million consumer class-action settlement earlier in 2015. The pattern across these negotiations: issuers hold real veto power over network-mediated deals, and walking away moves the price.
First-order effects
- Target's direct breach bill rises again, adding $39.4 million to a settlement ledger that already includes the Visa deal, the class action, and its own $162 million cost estimate — paid to reimburse banks for fraud losses and card reissuance costs from the 2013 hack.
- MasterCard issuers who rejected the original $19 million offer more than double their recovery, validating the holdout strategy their Visa counterparts used.
Second-order effects
- Network-mediated settlements become a negotiation, not a take-it-or-leave-it: issuers now have a demonstrated playbook of rejecting lowball offers, which raises the opening price every breached merchant must expect to pay.
- For retailers watching Target's ledger grow, breach insurance premiums and security spending shift from discretionary to board-level line items, since the marginal cost of weak card-data protection is now measured in eight-figure issuer payouts.
Third-order effects
- If this pattern holds, large retail breaches resolve through a standard sequence — network deal, issuer holdout, re-price, then state AG and class-action layers — making breach liability predictable enough to price into payment-processing contracts and merchant agreements.
- The eventual endgame visible in Target's own trajectory is remediation written into settlements: once regulators extract commitments like segmenting cardholder data and two-factor authentication, security architecture stops being a competitive choice and becomes a condition of doing business on the card rails.
The trend: Major retail data breaches are resolving into multi-year, multi-front settlement campaigns in which card-issuing banks' collective bargaining power, not the networks alone, sets the final price of a breach.