Target reaches $18.5M multi-state settlement over 2013 data breach, agrees to separate cardholder data from rest of network, implement two-factor authentication
Nicole Hong / Wall Street Journal :
Context & Ripple Effects
The 2013 breach has been settling in layers for two years: first a $10M consumer class action, then the card networks — an initial MasterCard offer rejected by big issuers before Target paid up to $67M to Visa and a $39.4M deal with banks and MasterCard issuers. What closes today is the third layer: state attorneys general extracting not just money but specific security commitments.
That makes this settlement different in kind from the earlier ones. The Visa and bank deals compensated issuers for fraud losses; the $18.5M here buys regulatory peace while binding Target to architectural fixes — separating cardholder data from the rest of its network and adding two-factor authentication.
First-order effects
- Target pays $18.5M to the states and takes on ongoing compliance obligations — network segmentation for cardholder data and two-factor authentication — turning a one-time payout into a durable engineering mandate.
- With banks, Visa, consumers, and now states all settled, the direct litigation tail of the 2013 breach is effectively closed for Target.
Second-order effects
- Other retailers hit by point-of-sale breaches now face a template where state AGs demand named technical controls, not just compensation — raising the price of resisting early on security remediation.
- Payment processors and POS vendors gain a selling point: segmentation and two-factor auth are no longer best practice but settlement-mandated baseline, shifting procurement toward systems that ship them by default.
Third-order effects
- State attorneys general are consolidating into a standing enforcement layer for corporate data security, able to impose specific architectures on national retailers even after federal and private claims resolve.
- If the pattern holds, breach settlements increasingly function as de facto security regulation — courts and AGs writing network design requirements that legislatures have not.
The trend: Data-breach liability is compounding across constituencies — issuers, consumers, and now states — and shifting from compensating victims to dictating security architecture.