Target settles consumer data breach suit, strengthens banks’ case

On March 19, Target Corp. agreed to pay $10 million to settle a class action lawsuit brought by consumers harmed by its 2013 data breach. The deal strengthens the case of the banking industry which is asking Target and other retailers to cover the hundreds of millions of dollars incurred protecting their customers from losses, said American Bankers Association President and CEO Frank Keating..After covering consumers' losses from its data breach, "Target should step up and cover [the banking industry's] costs too," he said, in a press release. "This settlement does little to address the real problem – stopping a breach before it happens. Target − and the many other retailers who have suffered recent breaches due to holes in their internal computer defenses − should be forced to do more.".Under the consumer settlement proposed, Target will provide a fund of up to $10 million to be distributed through a claims process to class members who suffered identity theft as a result of the breach. Individual customers must submit a claim to receive payment from Target. The amount the retailer will pay out per customer is capped at $10,000. .The settlement also would be required to adopt and implement data security measures such as appointing a chief information security officer and maintaining a written information security program. U.S. District Judge Paul Magnuson has given preliminary approval to the deal..Magnuson also rejected Target's bid to dismiss a lawsuit by financial institutions in December. The plaintiffs − Umpqua Holdings Corp's Umpqua Bank in Roseburg, Oregon; Mutual Bank in Whitman, Mass.; Village Bank in St. Francis, Minn.; CSE Federal Credit Union in Lake Charles, La.; and First Federal Savings of Lorain in Lorain, Ohio – are seeking to recoup money spent reimbursing customers for fraudulent charges and issuing new credit and debit cards.."Plaintiffs have plausibly alleged that Target's actions and inactions – disabling certain security features and failing to heed the warning signs as the hackers' attack began – caused foreseeable harm to plaintiffs," Magnuson wrote in the decision. "Plaintiffs have also plausibly alleged that Target's conduct both caused and exacerbated the harm they suffered.".Hackers stole information connected with some 40 million credit cards including the email addresses and phone numbers of about 110 million people. Funds paid under the settlement would be among the first reimbursements Target has made to consumers since its data breach.