Target Corp. has agreed to pay Visa card issuers up to $67 million to resolve claims related to the massive cyberattack the retailer suffered in 2013, The Wall Street Journal reports.
The highly publicized breach during the busy holiday season exposed up to 40 million credit cards and compromised other personal information on as many as 70 million people. Although the exact extent of fraud committed as a result of the breach isn’t known, the attack has cost Target $162 million in net expenses as of Jan. 31.
“Visa has worked to help Target reach a resolution for the expenses incurred as result of the 2013 compromise,” Visa said in a statement. “This agreement attempts to put this event behind us.”
Retailers are under increasing pressure from consumer rights advocates to improve data security practices that are falling behind industry standards. A March survey found that four in five companies failed tests to determine whether their practices complied with a baseline security standard created by payment card issuers like MasterCard and Visa.
Prompted by high-profile breaches at Target, Home Depot and Anthem, lawmakers introduced a spate of legislation this year that could potentially force the retail industry to adhere to stricter guidelines for data security.
Currently, companies say they are struggling to comply with the patchwork of state-to-state regulations. Most of the many offerings would require companies to disclose data breaches within a set period of time and adhere to a national standard for data security — although at least one bill would not prevent states from enacting stricter laws of their own.
The Visa settlement is not the first such agreement Target has reached in the wake of the breach. The retailer agreed to a $10 million settlement in a class-action suit brought by exposed customers in March.
Three months ago, MasterCard rejected a proposed $19 million settlement when an insufficient number of issuing banks refused to accept the deal.