Target says SEC will not pursue enforcement action over data breach

Target Corporation announced this week that the Securities and Exchange Commission (SEC) will not pursue an enforcement action over the retailer’s 2013’s data breach.

Target made the announcement in a 10-Q financial filing last week. After experiencing one of the highest-profile data breaches during the holiday season of 2013, Target fielded class action lawsuits from both consumers and payment card issuing financial institutions seeking to recoup the costs of replacing credit and debit cards involved in the breach.

Target also revealed that its data breach costs have far outstripped its cyber insurance recoveries.

“Since the data breach, we have incurred $264 million of cumulative expenses, partially offset by expected insurance recoveries of $90 million, for net cumulative expenses of $174 million,” stated Target in the financial filing.

The retailer also detailed its cyber insurance arrangements, commenting, “To limit our exposure to losses relating to data breach and other claims, we maintained $100 million of network-security insurance coverage during the period that the data breach occurred, above a $10 million deductible and with a $50 million sublimit for settlements with the payment card networks. This coverage, and certain other customary business-insurance coverage, has reduced our exposure related to the data breach. We will pursue recoveries to the maximum extent available under the policies. Since the data breach, we have received $35 million from our network-security insurance carriers of the $90 million accrued.”

Target’s filing goes further in explaining the contingent effects on the overall business as a result of the data breach, including higher promotional activity following the breach, the costs of converting Target-branded payment cards to chip-and-pin technology, and resolving lawsuits.