May 23, 2017
Carson City, NV – Today, Nevada Attorney General Adam Paul Laxalt, along with 47 other states and the District of Columbia, announced an $18.5 million settlement with Target Corporation. The settlement resolves the states’ investigation into the retail company's 2013 data breach affecting more than 41 million customer payment card accounts and contact information for more than 60 million customers.
The states' investigation found that, on or about November 12, 2013, cyber attackers accessed Target's gateway server through credentials stolen from a third-party vendor. The credentials were then used to exploit weaknesses in Target's system, allowing the attackers to access a customer service database; to install malware on the system; and to capture data, including consumer data comprised of full names, telephone numbers, email addresses and mailing addresses, payment card numbers, expiration dates and CVV1 codes, and encrypted debit PINs.
“This settlement represents the largest multi-state data breach settlement achieved,” said Laxalt. “Data breaches pose a unique threat to our community by exposing personal identifying information, and my office remains committed to combating high tech crime and keeping the identities of Nevadans safe.”
In addition to the monetary payment to the states, the settlement agreement requires Target to develop, implement and maintain a comprehensive information security program, as well as to employ an executive or officer who is responsible for executing the plan. Among other network security measures, the settlement requires Target to maintain appropriate encryption policies and control access to its network, including implementing password rotation policies and two-factor authentication for certain accounts.
At the time of the breach, Target operated 19 stores in Nevada. The State of Nevada will receive $221,090.42 from the settlement.
In addition to Nevada, other states participating in this settlement include: Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington and West Virginia and the District of Columbia.
Senior Deputy Attorney General Lucas Tucker and Deputy Attorney General Laura Tucker of the Attorney General’s Bureau of Consumer Protection represented Nevada in this matter.
The settlement is attached.
###