Stay Curious. Stay Connected.
MailNewsletters♡Donate Now
Sign up
*Password must be at least 8 characters and contain one uppercase letter, one lowercase letter, one number and one symbol.
Already have an account?
By submitting, you consent that you are at least 18 years of age and to receive information about MPR's or APMG entities' programs and offerings. The personally identifying information you provide will not be sold, shared, or used for purposes other than to communicate with you about MPR, APMG entities, and its sponsors. You may opt-out at any time clicking the unsubscribe link at the bottom of any email communication. View our Privacy Policy.
Sign in to your profile
Forgot Password?
New to MPR News?
Welcome back
to news
for you
Reset Password

Enter the username on file and we'll send you a code to reset your password.

Still require assistance or not sure what your User Name is?
Welcome back
to news
for you
Email Verification

A verification code has been emailed to

Still awaiting the code?
The Associated Press
New York

NY Attorney General: $18.5 million settlement with Target

Target store
In this Thursday, July 5, 2012, file photo, rows of carts await customers at a Target store in Chicago.
M. Spencer Green | AP 2012

Go Deeper.

Create an account or log in to save stories.

Log inCreate a free Account

Like this?

Thanks for liking this story! We have added it to a list of your favorite stories.

Show me!

Target Corp. has reached an $18.5 million settlement over a massive data breach that occurred before Christmas in 2013, New York's attorney general announced Tuesday.

The agreement involving 47 states and the District of Columbia is the largest multistate data breach settlement to date, Attorney General Eric T. Schneiderman's office said. The settlement, which stipulates some security measures the retailer must adhere to, resolves the states' probe into the breach.

Target spokeswoman Jenna Reck said in a statement that the company has been working with state authorities for several years to address claims related to the breach.

"We're pleased to bring this issue to a resolution for everyone involved," she said.

Target had announced the breach on Dec. 19, 2013, saying it had occurred between Nov. 27 and Dec. 15 of that year. It affected more than 41 million customer payment card accounts and exposed contact information for more than 60 million customers.

The breach forced Target to overhaul its security system and the company offered free credit reports for potentially affected shoppers. Target's sales, profit and stock price all suffered months after the disclosure as shoppers were nervous about their security of their credit cards. The breach also contributed to the departure of Target's then-CEO, chairman and president Gregg Steinhafel, who resigned in May 2014.

An investigation by the states found that in November 2013, scammers got access to Target's server through credentials stolen from a third-party vendor. They used those credentials to take advantage of holes in Target's systems, accessing a customer service database and installing malware that was used to capture data, including full customer names, telephone numbers, email and mailing addresses, credit card numbers, expiration dates and encrypted debit PINs.

The settlement requires Target to maintain appropriate encryption policies and take other security steps. Reck said the costs of the settlement are already reflected in the reserves that Target has previously disclosed.