Target and Card Issuers Reach Final Data Breach Settlement
Two years after the massive holiday season theft of customers’ payment card data from Target point of sale terminals, the Target data breach litigation appears to be entering its final act. On Tuesday, December 1, Target entered into a settlement agreement with a class of banks and financial institutions that issued the credit and debit cards that were compromised in the 2013 event. The settlement was the result of negotiations following closely on the heels of an order by the court certifying a card issuer class. This last settlement resolves card issuers’ claims that were not previously resolved in Target’s August 2015 settlement with Visa, which provided $67 million to resolve claims made by Visa card issuing banks under Visa’s fraud resolution process. Also separate from this settlement is the $10 million settlement of the claims of consumers whose cards were compromised by the data theft, which Target concluded with the consumer class in March 2015.
The current settlement provides for payment of an additional $39,357,939.38 for the benefit of class member banks. Of that amount, $19,107,939.38 will be used to fund settlements under MasterCard’s fraud resolution process, which had been the subject of a prior failed attempt by Target to reach a binding settlement of those claims. Of the remaining $20,250,000 provided in the settlement, up to $500,000 will be set aside to cover the cost of providing notice to the class, while the balance will be distributed as settlement payments in connection with card issuer claims not covered by the Visa and MasterCard claims resolution processes (including claims by issuers of Discover and American Express cards). All amounts paid by Target will be distributed to class members, with any amounts remaining after the various claims resolution processes to be distributed pro rata to members of the card issuer class.
Class counsel will make a separate application to the court for attorneys’ fees and class representative incentive awards. The incentive award request will seek $20,000 apiece for each of the five class representative banks. Amounts that the court awards to class counsel and the class representatives will be paid in addition to the amounts paid for the benefit for the class, such that those awards will not reduce the amount paid to the class members under the settlement. Target has the right to contest the class counsel fee application before the District Court, but has waived any right to appeal any fee award of $20 million or less.
Class members will receive notice of the settlement. Class members who want to be excluded from the settlement have the right to opt out of the class. Class members who decline to opt out have the right to submit written objections to the settlement terms. As in all federal court class action settlements, notice also must be provided to state and federal authorities, who have up to 90 days to decide whether to weigh in. If banks that issued more than 5% of the compromised card accounts opt out of the settlement, Target will have the right either to terminate the settlement or to reduce the size of the settlement fund in accordance with a formula set out in the settlement agreement. The settlement is subject to final approval by the court after conclusion of the notice, opt-out and objection period. Given required waiting periods for notice and government review, the final approval hearing is unlikely to issue before the second calendar quarter of 2016.
With this contemplated settlement, Target will have committed to pay settlements arising from the 2013 data breach (excluding the as-yet undetermined attorneys’ fees) totaling more than $116,000,000. According to Target’s Form 10-Q report for the period ended October 31, 2015, Target has recorded $290,000,000 in expenses arising from the data breach, of which $90,000,000 has been covered by insurance. The total expenses reported by Target include “an adjustment to the accrual in the third quarter of 2015 based on refined estimates of our probable exposure.” It is not possible to determine at this point whether that accrual was sufficient to cover the full amount of the settlement and potential fee award under the current settlement. Future reporting by Target, after fees are awarded and the settlements become final, will provide greater clarity as to the total cost of this event.
Author
