Nebraska and 46 other states and the District of Columbia will share in an $18.5 million settlement in regard to the 2013 data breach at the Target corporation. Nebraska will receive $199,382.20 from the settlement, Nebraska Attorney General Doug Peterson announced Wednesday
The settlement represents the largest multistate data breach settlement achieved to date, Peterson said.
Led by Connecticut and Illinois, the states' investigation found that, on or about Nov. 12, 2013, cyber attackers accessed Target's gateway server through credentials stolen from a third-party vendor.
The credentials were used to exploit weaknesses in Target's system, which allowed the attackers to access a customer service database, install malware on the system and capture data. The hackers accessed full names, telephone numbers, email and mailing addresses, payment card numbers, expiration dates, CVV1 codes, and encrypted debit PINs, Peterson said.
The breach affected more than 41 million customer payment card accounts and contact information for more than 60 million customers.
In addition to the monetary payment to the states, the settlement agreement requires Target to develop, implement, and maintain a comprehensive information security program and to employ an executive or officer who is responsible for executing the plan.
The company is required to hire an independent, qualified third-party to conduct a comprehensive security assessment.
The settlement further requires Target to maintain and support software on its network; to maintain appropriate encryption policies, particularly as pertains to cardholder and personal information data; to segment its cardholder data environment from the rest of its computer network; and undertake steps to control access to its network, including implementing password rotation policies and two-factor authentication for certain accounts.
In addition to Nebraska, other states participating in the settlement are Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington and West Virginia and the District of Columbia, Peterson said.
To obtain information about how to protect yourself as a consumer, file a consumer complaint, or report a scam, please visit the Nebraska Attorney General’s Office, Consumer Protection Division website at www.protectthegoodlife.nebraska.gov or call (800) 727-6432.