The Target and Other Financial Data Breaches: Frequently Asked Questions
Released: 2015-02-04T00:00:00

What Were Some Recent Financial Data Breaches?

In recent years, financial data breaches have exposed a variety of personal information concerning finances, personally identifiable information (PII), health care, legal issues, and more. The theft of this information was accomplished by outsiders hacking computer systems, insiders with and without authorized access to the files, loss of laptops and other physical media, and accidental publication. According to one source, 78% of all records compromised during the first six months of 2014 were exposed as the result of outsiders.

Recent large financial data breaches affecting the payment system include

Target: 2013, 40 million payment cards, 70 million records of customer names, addresses, telephone numbers, and email addresses; Adobe: 2013, 152 million customer names, encrypted passwords, encrypted payment card information; Home Depot: 2014, 56 million customer email addresses and payment cards; Heartland: 2009, 130 million payment card records; and TJX: 2007, 94 million payment card records (credit card numbers and transactions).

This report concentrates on the loss of financial data, but there have also been nonfinancial data breaches, including

Sony Corporation (PlayStation Network): 2011, 77 million names, addresses, email addresses, and other personal information; Sony Picture Entertainment: 2014, a large, but unknown number of files reportedly containing personal information, internal Sony discussions, and unreleased movies, and other; JPMorgan Chase & Co. (JPMorgan): 2014, 76 million household customer names, telephone numbers, and other information and 7 million small business records; and Tricare Management Activity: 2011, 4.9 medical records lost.

Breaches have also occurred in other nations, including Korea (2014), the theft of 220 million records containing personal information and passwords, and China (2012), 150 million records stolen from Shanghai Roadway & Marketing.

Target Breach

According to Target, in November and December of 2013, information on 40 million payment cards (i.e., credit, debit, and ATM cards) and personally identifiable information (PII) on 70 million customers was compromised. The Secret Service has announced that it is investigating the data breach, but has released no details. In congressional hearings, Target's executive vice president testified that an intruder used a vendor's access to Target's system to place malware on point-of-sale (POS) registers. The malware captured credit and debit card information before it was encrypted, which would render it more difficult (or impossible) to read. In addition, the intruder captured some strongly encrypted personal identification numbers (PIN).

It is very unlikely that all 40 million payment cards compromised at Target will be used in fraudulent transactions. Some cards will be canceled before they are used, some attempts to use valid cards will be denied by the issuing financial institutions, and there will be no attempt to make fraudulent use of some.

According to media reports, some financial institutions responded to the Target breach by issuing new cards to all of their cardholders, and others decided to depend on antifraud monitoring. Initially, Wells Fargo, Citibank, and JPMorgan Chase replaced debit cards, but not credit cards, and Bank of America and U.S. Bank are depending on fraud detection.

Target Breach Timeline

Companies that suffer data breaches rarely publish detailed timelines. Target, possibly because senior management testified before Congress on the situation, is an exception to this rule.

According to testimony of John J. Mulligan, executive vice president and chief financial officer of Target, the key dates in the Target breach are as follows:

November 12, 2013—intruders breached Target's computer system. The intrusion was detected by Target's security systems, but the company's security professionals took no action until notified by law enforcement of the breach. December 12, 2013—the Department of Justice (DOJ) notified Target that there was suspicious activity involving payment cards that had been used at Target. December 13, 2013—Target met with DOJ and the U.S. Secret Service. December 14, 2013—Target hired outside experts to conduct a thorough forensic investigation. December 15, 2013—Target confirmed that malware had been installed and that most of the malware had been removed. December 16 and 17, 2013—Target notified payment processors and card networks that a breach had occurred. December 18, 2013—Target removed the remaining malware. December 19, 2013—Target made a public announcement of the breach. December 27, 2013—Target announced the theft of the encrypted PIN data. January 9, 2014—Target discovered the theft of PII. January 10, 2014—Target announced the PII theft.

Target estimates that the 40 million payment card and 70 million PII data breaches have at least 12 million people in common, making 98 million the maximum number of customers affected.

Fazio Mechanical Services, which provided heating, ventilation, and air conditioning (HVAC) services for Target, has said it was used to breach Target's payment system. A Fazio computer authorized to submit contract billing and project management information to Target reportedly was compromised by intruders. According to some media reports, Fazio was the victim of a phishing email containing malware that was used to install other malware in Target's network, including its POS system that records payment card transactions.

Payment card companies require any business accepting payment cards to follow PCI rules regarding security of their payment card processing. Target has testified that its systems were reviewed in September 2013 and certified as compliant.

The magnetic stripes on the back of U.S. credit cards are not encrypted. According to media reports, malware known as a "memory scraper" captured information from customers' payment cards by reading the POS system's memory before it was encrypted.

After the initial announcement of the Target data breach, other possibly related data breaches were reported, including at Neiman Marcus (a luxury retailer), Michaels (an arts and crafts retailer), Home Depot, OneStopParking, and White Lodging (a hotel management company), which had been notified by law enforcement that they had suffered related data breaches.

In summary, it appears that

1. someone obtained a vendor's credentials to access the Target vendor billing and invoicing system, 2. access to the vendor billing and invoicing system was escalated to access into Target's POS system, 3. this was used to introduce malware into the system, 4. warnings about this malware were initially ignored, 5. Target software was used to spread the malware to virtually all of Target's POS devices, 6. the credit card data were stored in innocuously named files and sent to servers outside Target's system and then on to other servers, and 7. warnings about transmitting the data were ignored.

JPMorgan Chase & Co. Breach

On October 2, 2014, JPMorgan Chase reported to the Securities and Exchange Commission (SEC) that a cyberattack had compromised the PII of approximately 76 million households and 7 million small businesses. The compromised PII included names, addresses, phone numbers, email addresses, and "internal JPMorgan Chase information relating to such users." According to the company's filing, there was no evidence that account information, user IDs, passwords, social security numbers, or birth dates for the affected customers were compromised. The company said that it had not seen any unusual customer fraud related to the incident. It reassured customers that they would not be liable for any unauthorized activity on their accounts, if it were reported promptly.

Prior to the October 2 filing, the firm's disclosure of the incident was general. In its regular report for the second quarter of 2014, JPMorgan Chase stated, "The Firm is also regularly targeted by unauthorized parties using malicious code and viruses, and has also experienced other attempts to breach the security of the Firm's systems and data which, in certain instances, have resulted in unauthorized access to customer account data."

According to media reports, hackers gained access sometime in mid-June 2014 to JPMorgan servers storing contact information for current and former customers who had accessed the company's chase.com or jpmorgan.com websites or mobile applications in recent years. According to media reports, the company learned of the data breach in mid-August and took steps to stop any unauthorized access at its servers. On August 27, 2014, Bloomberg and The Wall Street Journal both reported that the Federal Bureau of Investigations (FBI) was investigating a possible computer hacking attack on JPMorgan and possibly other financial institutions.

The FBI later released a statement that it was "working with the United States Secret Service to determine the scope of recently reported cyberattacks against several American financial institutions." On August 28, 2014, JPMorgan reiterated to customers that it was not seeing an "unusual fraud activity," in other words, it appears that the hackers have not used the information they obtained for fraudulent purposes. JPMorgan continued by stating that the hackers went to considerable effort, but were unable to monetize the information that they stole. Of course, it could be that they are simply waiting until a later date or that their monetization of the information has been undetected.

According to the New York Times , the same hackers—believed to be located overseas—who breached JPMorgan's network also infiltrated the website for the JPMorgan Corporate Challenge, run by an outside vendor for the bank on a server maintained by an outside Internet firm. JPMorgan has not announced how hackers penetrated its network, but the bank said they did not gain access through the Corporate Challenge website.

What Are the Cost Estimates of These Data Breaches?

This section looks at the costs reported by companies in three data breaches: Target, Home Depot, and JPMorgan. These costs typically include only direct costs, such as hiring consultants and staff to end the breach and to prevent future breaches, and contractually agreed compensation to business partners (such as payment card companies) for their losses. Not all companies include the savings from the tax deductibility of these costs or insurance claims. Many costs, especially those resulting from legal action against the companies, will not be known for many years after the data breach.

Target Cost Estimates

Target has reported that as of its quarter that ended November 1, 2014, it had cumulatively incurred $248 million in data breach related expenses and received (or expected to receive) $90 million from insurance policies. This includes the cost of investigating the breach, providing credit-monitoring services, increasing call center staffing, other professional services, and "an accrual related to the expected payment card networks' counterfeit fraud losses and non-ordinary course operating expenses." These costs include allowances for defending and/or settling more than 100 legal actions filed against Target. In addition, the payment networks have made claims for reimbursement for incremental expenses, such as counterfeit fraud losses and card reissuance.

Jefferies, an investment bank, quotes an industry expert, Julie Conroy, who estimates that 4.8-7.2 million cards will be used to charge $1.4-$2.2 billion fraudulently. Ms. Conroy said that card issuers are liable for the fraud except when the card is not present at the time of the purchase (e.g., telephone and online purchases). Ms. Conroy is quoted by Jefferies as estimating that the Payment Cards Industry (PCI) Council, founded in 2006 by the main payment card companies (i.e., Visa, MasterCard, American Express, Discover, and JCB) to establish industry security standards, could fine Target between $400 million and $1.1 billion.

According to Jefferies, Ms. Conroy said that, in general, the largest payment card issuers are better at fraud detection than the other issuers. She estimated that 10%-15% of the cards issued by the financial institutions with the most sophisticated detection systems would have fraudulent charges, whereas 20%-30% of the cards issued by other financial institutions would have fraudulent charges.

Others have made lower forecasts of the volume of fraudulent transactions that will occur in the Target case. For example, Ellen Richey, chief enterprise risk officer of Visa, testified that 2%-5% of compromised Visa cards experience fraud. Using the same $300 of fraud per card that Ms. Conroy used, fraudulent charges could be $240-$600 million.

To provide some context, Target has reported 2013 net income of $3.0 billion and stockholders' equity of $16.6 billion for the fiscal year ending February 1, 2014. If Target's cost of the data breach were to be a $1.1 billion PCI fine that would be 37% of their 2013 net income and 7% of 2013 stockholder's equity. In contrast, combining Ms. Conroy's assumption that PCI fines could be 30%-50% of fraudulent charges with Visa's low-end estimate of 2% of cards being used fraudulently, the estimated PCI fine would be $72 million, which is 2% of 2013 net income and less than 1% of 2013 stockholders' equity.

Home Depot Cost Estimates

On September 18, 2013, Home Depot reported it had been notified by banks and law enforcement of unusual payment system activity, and on November 6, 2013, it announced that approximately 53 million customer email addresses had been compromised. It was later announced that 56 million payment cards had been compromised.

Home Depot reports that at least 44 legal actions in the United States and Canada had been filed against it as a result of the data breach. As of the third quarter of 2014, Home Depot reported $43 million in data breach-related expenses and anticipated $15 million in insurance payments. Home Depot reported $5.4 billion in net earnings for the fiscal year ending February 2, 2014.

Brian Krebs, a computer security research and blogger, has attributed the Home Depot data breach to the same malware used against Target.

How Does the Payment Card System Work?

The payment card system encompasses cards that can be used as payment for purchases. Credit cards, debit cards, automatic teller machine (ATM) cards, and prepaid cards are the most widely used payment cards. The two basic approaches to payment card systems differ in the number of parties to the transaction. The most common is the four-party system, which is used by MasterCard and Visa. This system involves a merchant , an acquirer (the merchant's bank), the issuer (the customer's bank), and the cardholder . The alternative called the three-party system—used by companies such as Diners Club, Discover, and American Express—consists of the merchant, the payment card company, and the cardholder.

Four-Party Transactions

Figure 1 illustrates a typical purchase using the four-party system.

1. A cardholder presents a payment card to a retailer to pay for merchandise. The card is "swiped" and information about the card and the purchases is sent to the retailer's computers in a secured room. 2. This transaction is transmitted to the acquirer (i.e., the retailer's bank). 3. The acquirer relays the transaction information to the payment card company , which may conduct an anti-fraud analysis. 4. The payment card sends this information to the issuer , the bank that issued the payment card. The issuer verifies that the account is valid, that the cardholder has available credit, and it may perform additional anti-fraud analysis. 5. The issuer notifies the payment card company of its decision to authorize (or not to authorize) the transaction. 6. The payment card company notifies the acquirer of the issuer's authorization decision. 7. The acquirer notifies the merchant of the issuer's authorization decision. 8. The cardholder leaves with their purchases. 9. The issuing financial institution (bank, credit union, etc.) pays the acquirer and posts the amount of the purchase to the cardholder's account. The acquirer receives the amount minus an interchange fee charged by the payment network. 10. The acquirer deducts a fee and credits the merchant with the balance. 11. The cardholder receives a monthly bill. 12. The cardholder makes a payment on the monthly bill.

Both the interchange fees and the merchant discounts depend on a number of factors related to risk and cost. Was the card physically present or was the transaction done by telephone or Internet? Was the receipt signed or was a PIN used? What business is the merchant in? What has been the card network's experience with the merchant? Is the customer in a foreign country? Do the funds have to be converted to another currency? Is the card a credit card, a debit card, or a prepaid card? Is the card a standard, premium, or affluent card? Is the cardholder an individual or a business?

Three-Party Transactions

In the three-party system, the merchant sends the transaction information directly to the payment card company, which sends the funds to the merchant (less fees) and lends the cardholder the funds for the purchase.

In 2013, four-party payment cards (Visa and MasterCard) dominated the payments system. In 2013, as measured in dollars, Visa's share was 56% and MasterCard's was 26%. American Express's share in 2013 was 15% and Discover's was 3%.

Many merchants contract with outside payment processors to manage the payment process between the POS and the acquirer (four-party system) or the payment card (three-party system). The payment processors are approved by PCI. Payment processors include large international banks, such as JPMorgan Chase; financial services companies, such as Heartland Payments and First Data; technology startups, such as SquaredUp; and established technology firms, such as Google and Yahoo.

In theory, credit card security can be compromised anywhere in the system: at the point of sale, transmission of the information, at either of the banks, or at the payment card company. An attacker can come directly from the outside, or it can infiltrate an authorized user to obtain access.

Why Do Financial Data Breaches, Especially in the Retail Industry, Keep Happening?

There are economic, technological, and strategic reasons why payment card breaches continue to occur. The crime can be profitable and those involved are thought to have relatively little risk of arrest. For a group with an inclination toward crime, using the Internet to steal financial data would appear to offer large rewards, little cost, and relatively little risk of arrest.

Obtaining cardholder information has been profitable, and obtaining the information on thousands or millions of cardholders has been even more profitable. Although law enforcement authorities try to identify, arrest, and prosecute those responsible, international cooperation can be less than what might be desired, which reduces the risks to those responsible for the breaches.

Merchants, banks, and payment cards share costs and benefits, but the desire to minimize costs, including the cost of a new technology to deter payment card breaches, may involve shifting the expense to someone else. Cyber technology and business efficiencies for merchants, banks, payment cards, payment processors, and cybercriminals are constantly evolving.

Magnetic Stripe versus Chip Systems

The incentives to improve cybersecurity are divided along the transaction path of merchant, acquirer (the merchant's bank), payment card company, issuing bank, and cardholder. In the aftermath of the Target case, some merchants have complained that the current magnetic stripe and signature system should be replaced with a Chip and PIN system, which would use the EMV computer chip—named after EuroPay, MasterCard and Visa, which developed it—to encrypt payment information. It presents a coordination problem: until the entire payment system—businesses accepting payment cards, issuing banks, acquiring banks, and the payment card companies—adopts CHIP and PIN or CHIP and Signature, there are the costs to those that adopt the heightened security, but no benefits. An additional concern is that some customers, perhaps from other countries, may have cards without a CHIP so businesses want a fall-back mechanism even after they have adopted CHIP reading terminals.

The payment card industry has announced that effective October 1, 2015, liability for fraudulent transactions (except for ATMs and gas stations) will be assigned to the merchant or issuer that is not Chip and Signature compliant.

For a number of years, payment card companies have argued that Chip and Signature was unnecessary in the United States because POS terminals are connected to the payment system allowing for immediate (real-time) approval. One advantage of Chip and Signature/PIN is that it can be used to approve purchases even if no computer connection is available to the issuing bank and payment card company.

Another advantage is that Chip-based systems are supposed to make it more difficult for unauthorized persons to duplicate payment cards compared with the cards used in the United States presently.

Some banks in the United States have begun issuing Chip and Signature cards to certain customers. According to a multi-industry trade group, the Smart Card Alliance, Chip and Signature cards are currently issued by 17 financial institutions, including some of the largest volume issuers. Outside of the United States, more than 75% of terminals and 45% of payment cards use an EMV chip.

In short, chip-based cards could reduce the cost of fraud because they are more difficult (but not impossible) to forge, but they do not prevent the theft of account information. On the other hand, fraud involving Internet, telephone, and mail orders does not require a payment card to be present. Compared with signature-based authentication, PINs make it harder (but not impossible) to use a stolen card.

What Industry Best Practices Have Been Adopted?

The current payment card system in the United States is based on payment cards that have magnetic stripes on the back that contain the account number, cardholder name, service code, expiration date, and other information in an unencrypted format. This unencrypted information is necessarily read into the merchant's payment processing system unencrypted and potentially vulnerable for a fraction of a second. A secure card reader encrypts the data before sending it to the merchant's server for transmission to the acquiring bank, but it is theoretically possible to intercept the information inside the card reader before it has been encrypted.

Current PCI standards require encryption only when cardholder data are transmitted over public networks such as the Internet and when they are stored. The magnetic stripe and signature card suffers from a number of weaknesses:

Card information on the magnetic stripe is not encrypted and can easily be read. It reportedly is easy to forge magnetic stripe cards. The signature on the back of a card provides a criminal with an example of the authentic signature, electronic signature pads can be difficult to sign in a manner that resembles the signature on the card, and the payment cards do not allow merchants to decline a transaction based on the signature of additional identity information, such as a driver's license.

A strength of the magnetic stripe and signature system used in the United States is that authorization is largely done online and in real time. If a card is known to be stolen or forged, purchases will not be authorized.

Although the magnetic stripe and signature system is the standard in the United States, in most of the rest of the world, a system thought to be more secure, the Chip and PIN system, has been adopted. Arguably, the system used in the United States is not the best practice, but for some the cost of converting has outweighed the expected cost of the fraud.

The Chip (also known as an EMV card after Europay, MasterCard, and Visa, which developed the standard) transmits the card information using encryption. The Chip, actually a small computer, can change the encryption every time it is used, making it nearly impossible for a criminal to capture and use cardholder information as it is transmitted and processed through the system.

Many Chip and PIN (or Chip and Signature) cards provide compatibility with magnetic stripe systems by adding a magnetic stripe, which potentially weakens their security. Chip and PIN is not foolproof; British researchers have demonstrated that there are a number of ways to bypass the security features of Chip and PIN cards. One response to Chip-based security has been to use cards stolen or forged in countries that do not use Chip.

According to congressional testimony, Chip and Signature increases security in two ways: (1) the information is encrypted and (2) it is more difficult to duplicate the Chip card. PIN adds another security factor that is called two-factor authentication.

The payment card companies have announced that effective October 1, 2015, a merchant or issuer who does not support Chip and Signature will be liable for most counterfeit card transactions. For gas stations and ATMs the shift is scheduled to occur October 1, 2017.

According to Chris McWilton, MasterCard's president of North America, the argument in favor of using a signature instead of a PIN like that on debit and ATM cards is that a signature is easier than a PIN for customers. He has also noted that banks will decide if it is worth their time to convert their systems to use a PIN and to issue PINs to customers.

According to Al Vrancart, a payment card consultant, the cost of producing a magnetic stripe card is about $0.50 compared with $2.20 to produce a chip card. New POS terminals could cost $300-$600 each. Mallory Duncan, general counsel of the National Retail Federation, has testified that new POS terminals cost "an average of $1,000 or more per unit," but this estimate appears to include the cost of modifying the system and training employees.

Other Emerging Technology Solutions

A number of technology solutions are emerging. Tokenization is a solution in which transaction information is stored on extremely secure servers known as vaults. Each transaction is indexed by a token that is used to access it. This token is essentially a random number and designed so that outsiders cannot take a payment card or transaction and create the token. The token cannot be used as a credit card number, and it cannot be used by anyone but the merchant in the transaction. This places great reliance on the security of the vault and the tokenization process. It may make it more cumbersome for merchants to analyze customer records to send targeted messages about new products or sales. Presumably the gains from the vault and tokenization process will outweigh the potential losses if the process is compromised.

With encryption , transaction information is transformed from plain text into an unintelligible format called cipher text. Secret keys are required for encrypting and decrypting the information. Most Internet transactions use session encryption known as https (hypertext transfer protocol secure) instead of the unencrypted http (hypertext transfer protocol). The actual transaction information can be separately encrypted instead of or in addition to using https. Separate data encryption is used when storing the information in a database.

Mobile payments and mobile banking are evolving alternatives in which mobile phones and tablets replace payment cards in financial transactions. The mobile device could be the customer's or the merchant could use a mobile device to process the customer's credit card. This raises questions about the security of the system: if a mobile device is stolen, can the owner's financial information be obtained and decrypted? If the customer is using an account with the merchant, how secure is the implementation? Is the transmission between the customer and the merchant secure? What are the security issues for various transmission technologies such as Bluetooth and near field communications (NFC), both of which allow the transaction to be completed without physical contact between the mobile device and the POS terminal? If the merchant is using a mobile device, what are its security strengths and weaknesses?

How Big Are Credit Card Data Breach Losses?

Many types of costs affect merchants, banks, payment cards, payment processors, consumers, and the party whose information is compromised. The response of those affected has an impact on the cost per record and the total cost. In 2007, Forrester Research surveyed 28 companies and estimated data breach costs of $90 to $305 per record. If this estimate is accurate for the Target case, the cost to Target's 40 million cards compromised could result in costs of $3.6 billion to $12.2 billion.

According to research by the Ponemon Institute, factors influencing the losses in data breaches include industry, existence of a privacy and data protection security policy, the type of information handled, the most likely cause of a data breach, whether data are stored on laptops or removable devices, whether data are encrypted, whether there is a full-time information security manager, number of employees, where in the world the company operates, policies concerning remote access to sensitive data, user authentication technology, headquarters location, and the number of sensitive records.

Table 1 summarizes various estimates of the cost to Target its data breach. These estimates range from $4.9 billion down to Target's reported losses of $11 million after insurance and taxes.

Ponemon estimated that a 2013 data breach in the retail sector would cost an average of $122 per record as compared with an average of $254 per card in the financial sector, and $304 in the health care sector. Costs included hiring outside experts, hiring a call center, the cost of cardholder credit monitoring, providing discounts to cardholders, reduced sales, and the cost of the staff response. If Target's cost turns out to be $122 per record, the total cost of the Target breach would be $4.9 billion. To date, Target has reported losses after insurance and taxes of $11 million.

This section of the report continues by looking at who bears the various costs of the payment breach in the first instance. It looks at the costs unique to merchants, banks, the payment processor, and consumers. It also examines the costs to the party breached. Ultimately private contracts among the various parties in the payment system and lawsuits can reallocate these costs.

The cost of reversing fraudulent transactions follows the entire chain of processing a payment card transaction, but—assuming that the funds can be recovered—this cost is likely to be relatively small.

Costs Unique to Merchants

In the case of payment card fraud, the issuing bank may issue a chargeback and retrieve the funds paid to the merchant who is unlikely to be able to retrieve the merchandise. Chargebacks can affect both the merchant breached and other merchants.

Sales may decline if customers lose confidence in the merchant and shop less frequently or purchase less when they shop. Target reported that its fourth quarter 2014 U.S. sales decreased 2.5% and were "meaningfully softer following the announcement" of the data breach. Among competing retailers not reporting recent data breaches, Walmart's comparable sales declined 0.4% in their fourth quarter 2014, and Costco's comparable U.S. sales increased 4% in the 18 weeks ending January 5, 2014.

Academic research in general finds that payment breaches have little long-lasting impact on a company's stock price , and this appears to be true for Target. Between December 18, 2013 (the day before the breach's public announcement), and March 3, 2014 (the first trading day in March 2014), Target's stock declined 0.3%, but Costco's stock declined 2.3% and Walmart's stock declined 4.9%.

Costs Unique to Card Issuers

One cost to issuers is the cost of issuing replacement cards . In the recent Target case, a figure of $10 per card issued has been widely used. This estimate appears to include the cost of obtaining new blank cards, embossing the cards, modifying accounts with the new account numbers, notifying cardholders, delivering the cards, and using a call center to answer questions related to the cancellation of the old cards and the issuance of the new ones.

Card issuers face the decision of which cards should be replaced. There may be a difference between the cards potentially compromised and those actually compromised. Not all cards actually compromised will be used in fraudulent transactions. Issuers that are better at detecting and preventing fraudulent charges may choose to replace fewer cards than other issuers.

Costs Unique to Payment Processors

Some merchants contract out payment processing to third-party contractors that connect a merchant with the acquiring financial institution. Services offered by payment processors range from handling the entire credit card process from POS to payment to the merchant's account and accounting to assessments of a merchant's compliance with PCI standards. Small merchants use payment processors because they do not have the need for a full-time staff of computer security specialists, and large merchants use them as a form of outsourcing for greater efficiency or to concentrate on the basic business.

Payment processors can be the victims of payment card data breaches. For example, in March 2012, Global Payments, a merchant payment processor, reported a data breach. "Certain" card networks temporarily suspended Global Payments as an authorized provider. Global Payments reported that as of May 31, 2013, its costs (before insurance payments) were $156.9 million consisting of $121.2 million for professional fees for investigation and remediation, incentive fees to business partners, credit monitoring, and identity protection, and an additional $35.7 million in fraud losses, fines and charges imposed by the card networks. Insurance covered $20.0 million. A class action lawsuit filed against Global Payments was dismissed.

According to media reports, about 1.5 million payment cards were affected, making the cost per card $104.

Costs Unique to Payment Cards

The four-party payment card companies (e.g., MasterCard and Visa) appear to largely avoid financial responsibility for data breaches and payment card fraud. In three-party payment systems, card companies (e.g., Diners Club, Discover, and American Express) bear credit risk from lending a cardholder the funds to pay the merchant. In the four-party system, the issuing bank, not the payment card company, bears the credit risk. Thus, the issuing bank, not the payment card company, in a four-party payment system, has potential exposure to the costs of payment card fraud. In the three-party network, the payment card company re-issues compromised cards, but in the four-party system it is the issuer's responsibility.

An examination of MasterCard's and Visa's annual reports found no explicit mention of expenses incurred because of fraud and data breaches. In contrast, American Express, Global Payments, and Heartland all mentioned these expenses.

Costs Unique to Consumers

Many costs to consumers can be difficult to value, but some are precisely known. Legally, the maximum cost to a consumer of a stolen credit card is $50. By law, the maximum cost to a consumer of a stolen debit card varies depending on how quickly the consumer notifies the card issuer: $50 if the issuer is notified within two business days discovering the loss or $500 if the notification is made more than two days after discovery and less than 60 days after receiving a statement. In practice, the payment card issuers do not charge a cardholder for fraudulent transactions. The breached organization frequently absorbs all of the fraudulent charges and provides free credit monitoring; consumers are to identify the fraudulent transactions and notify the card issuer. Consumers may also be subject to increased identity theft risks. Additional consumer costs include the loss of privacy, the time to monitor card use more closely, and the inconvenience of getting new cards.

Costs Incurred by the Party Breached

The cost to the entity breached can include lost sales, a damaged reputation, forensic examination, hiring outside experts, notifying cardholders, creating or expanding call centers to answer cardholders questions, offering cardholders credit or identity monitoring, additional compensation to customers, hiring an external public relations firm for damage control, legal expenses, increased regulatory oversight, fines by regulators or industry groups, diversion of staff to dealing with the breach, and enhanced security.

Who Ultimately Bears the Losses?

In data breaches such as Target's, who is liable for the costs associated with such data breaches depends on a web of individual contracts among retailers, the banks that issue cards and handle payments, credit card companies such as Visa and MasterCard, payment processors authorized by the credit card companies to process payments at the point of sale, and even contracts between a retailer and its third-party service provider (such as Target's HVAC contractor). These contracts allocate liability, the right to indemnification for breaches, and set certain duties and standards for cybersecurity protections, such as in the individually negotiated "representations and warranties" sections of such contracts.

Generally, the issuing financial institution pays the cost of card reissuance and for fraudulent charges made on compromised cards. Banks may sue the retailer for employing inadequate data security systems. A number of smaller financial institutions have filed class action lawsuits against Target under Minnesota state law, which reportedly has strict standards on data breach notification and minimum cybersecurity standards. (Target is headquartered in Minnesota.) The financial institutions claim damages, among other things, for costs associated with notifying customers of issues related to the Target data breach, closing out and opening new customer accounts, reissuing cards, and refunding customer losses resulting from unauthorized charges.

In some past data breach cases, merchants accused of using lax systems have paid significant costs of their own. For example, a data breach at T.J. Maxx was discovered in late 2006 and involved about 45 million debit and credit cards. To cover the eventual expenses of the breach, T.J. Maxx set aside $5 million in FY2007 and $198 million in FY2008, for a total of $203 million. By way of comparison, T.J. Maxx's profit was $1.4 billion in FY2007 and $1.6 billion in FY2008.

In sum, courts have been called upon to play key roles in deciding who should bear losses from data breaches like Target's. This is often done on a case-by-case basis, and often litigated under a variety of state laws. This has led to a lack of uniformity in the outcomes.

This situation has led to calls from some academics and media observers for Congress to examine the issue of who ultimately is responsible for the losses and who is in the best position to prevent losses. Some have also called on Congress to craft policy solutions allocating liability to those best able to minimize the threat of cybercrime and thereby protect consumers at the least cost. Because of the shared responsibility for cybersecurity over consumers' data, however, it may not be easy to determine which parties are in fact in the best position to minimize the threat of cybercrime and protect consumers. This is because customers' data are necessarily shared by retailers, payment card companies, payment processors, and financial institutions. Because breaches may occur at any point along this chain, deciding who should bear the cost of cybersecurity may not be straightforward.

To date, congressional hearings on the Target breaches have tended to focus more on policy solutions, such as notifying consumers that data breaches have occurred, and increasing or clarifying the FTC's authority to sanction lax data security practices. They have not focused on whether or how to allocate shared responsibility to the parties best positioned to protect against cyber breaches.

What Policy Options Are Being Discussed?

This section discusses selected policy options that have been raised in congressional hearings held on data security and breaches following the Target breach.

Passing a Federal Data Breach Notification Law

In each of the hearings related to the Target breach, various Members of Congress raised the possibility of a federal data breach notification law. Bills were introduced in the 113 th and earlier Congresses that would include some form of federal notification requirement for data security breaches. As will be discussed, 47 states presently have data breach notification laws.

The phrase "data breach notification" is somewhat ambiguous, particularly when details such as personal information are introduced into the equation. Generally speaking, however, a data security breach occurs when there is unauthorized access to sensitive personally identifiable information (PII) that could compromise the confidentiality or integrity of data. "Data breach notification" involves mandating that the company holding the PII notify those whose PII was compromised. Currently, only a few specific sectors of the private-sector economy are required by federal law to notify consumers when a data breach may have compromised their personal information, or PII. These include certain financial institutions covered by the Gramm-Leach-Bliley Act and certain health care entities covered by the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act). There is no comprehensive federal law governing the protection of data held by private actors. However, certain sectors are subject to cybersecurity obligations that may include data security. Nor is there any comprehensive federal law requiring notification of breaches of such private data.

According to the National Conference of State Legislatures, currently 47 states, the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands have passed laws requiring notification of security breaches involving personal information. Three states have not passed such laws: Alabama, New Mexico, and South Dakota. California in 2002 became the first state to pass such a law.

Businesses have complained about the patchwork of numerous, separate data breach notification laws they are required to comply with, citing burdensomeness and inefficiency. Business groups representing the financial and retail sectors, such as the Financial Services Roundtable and the National Retail Federation, have recently called for passage of a federal data breach notification law. Some state regulators, state attorneys general, and certain consumer groups have voiced concerns that a federal law could preempt state laws and prevent states from mandating stricter notification standards. A stronger federal data breach notification law, by contrast, appears to be more attractive to consumer groups. A number of businesses have called for enactment of a federal notification law as it may result in cost savings, by potentially eliminating the need to comply with 47 individual state laws. In addition, the executive branch has voiced support for a federal data breach notification law. Recent media reports have suggested that bipartisan consensus may be building around the necessity of a federal data breach notification law, although details remain divergent between various bills and proposals.

Generally, data breach notification laws include several components and address topics such as (1) which entities must comply with the law; (2) what information is being protected, and how a security breach or data breach is defined; (3) what degree of actual harm must occur, if any, for notice to be triggered; (4) how and when must notice be delivered; (5) are there any exceptions or safe harbors; (6) to what degree does this preempt state law and how does the law relate to other federal laws; and (7) what penalties, enforcement authorities, and remedies for those harmed does it create.

The data breach notification bills introduced in the 113 th Congress ( S. 1897 , S. 1193 , S. 1927 , S. 1976 , S. 1995 , H.R. 1468 , and H.R. 3990 ) addressed these elements in various ways. Some of these bills contained express preemption clauses that could potentially displace certain state laws on data breach notification in order to create a uniform data breach notification standard.

Modifying Federal Trade Commission Statutory Powers

Some in Congress have called for passage of a law to strengthen the Federal Trade Commission's (FTC's) statutory authority to penalize businesses that fail to adequately protect consumers' personally identifiable information. The FTC pursues enforcement actions against companies for failing to protect consumers' personal information.

Currently, the FTC relies on its statutory powers under Section 5 of the Federal Trade Commission Act to pursue data security violations. First, if a company makes materially misleading statements or omissions relating to an entity's data security practices and such statements or omissions are likely to mislead reasonable consumers, the FTC has argued that a company has engaged in unfair and deceptive practices prohibited by Section 5. The company can agree with the FTC, negotiate a consent agreement with the FTC, or deny the FTC's claim. In this latter situation, the FTC could sue the company, alleging they engaged in unfair and deceptive practices prohibited under Section 5. The FTC has reported that it has settled more than 30 matters on these grounds alone, in challenging companies' express or implied claims that they provided reasonable security for personal data. Second, if a company's data security practices either "cause or are likely to cause substantial injury to consumers that is not reasonably avoidable by consumers nor are outweighed by benefits to consumers or to competition," the FTC has argued that those practices can be found to violate Section 5 of the Federal Trade Commission Act. The FTC stated that it has settled more than 20 cases based on such allegations that a failure to reasonably safeguard consumer data was an unfair trade practice.

Despite the FTC's total of 50 settlements broadly related to data security since 2001, the Federal Trade Commission Act does not contain explicit statutory power for the FTC to levy civil penalties specifically for unfair or deceptive trade practices related to data breaches. The remedies agreed to in the settlements include the company agreeing to cease the unfair or deceptive trade practice but not paying extra penalties. For example, the FTC reached a data security settlement with TRENDnet, which involved a video camera designed to allow consumers to monitor their homes remotely. While TRENDnet marketed the cameras for in-home monitoring and claimed in product descriptions that the cameras were "secure," TRENDnet allegedly had software that left them open to online viewing by anyone with the cameras' web addresses, resulting in hackers posting 700 consumers' live feeds on the Internet. Pursuant to a settlement with the FTC, TRENDnet must maintain a comprehensive security program, obtain outside audits, notify consumers about the security issues and about software updates to correct them, and provide affected customers with free technical support for two years. But the FTC does not possess explicit statutory powers to impose monetary penalties or punitive fines on companies, such as TRENDnet or others, for unfair or deceptive trade practices related to a data breach. The FTC has asked Congress to pass legislation making explicit its authority in this area. The agency argues that having the explicit authority to impose fines or penalties as a result of an unfair or deceptive trade practice due to a data breach could provide a more useful deterrent effect. The FTC has also requested that it be given express statutory authority to issue rules and regulations and jurisdiction over non-profit companies, which may also store consumers' personal data.

The validity of the FTC's authority to pursue a company's data breach practices has recently been challenged in federal court. Some had predicted that the outcome of the court case could have affected the FTC's current enforcement authority over data security. In June 2012, following intermittent data breaches between 2008 and 2010, the FTC sued Wyndham hotel chains for allegedly misrepresenting the security measures the company took to protect consumers' personal information. In response, Wyndham filed a motion to dismiss the lawsuit in 2013. Wyndham claimed that "Section 5's prohibition on 'unfair' trade practices does not give the FTC authority to prescribe data-security standards for the private sector, particularly through selective enforcement actions that seek to impose after-the-fact Section 5 liability without any fair notice as to what the Commission believes Section 5 prohibits or requires." Some had predicted that, if the court had ruled in Wyndham's favor, then, barring any legislative action by Congress, future such lawsuits by the FTC over data security could become more problematic for the independent agency. However, on April 7, 2014, the U.S. District Court for the District of New Jersey denied Wyndham's motion to dismiss the FTC's lawsuit, ruling that the FTC had adequately stated claims that Wyndham engaged in unfair and deceptive practices.

Several bills introduced in the Senate in the 113 th Congress could have affected the FTC's powers. S. 1193 (Senator Toomey), S. 1897 (Senator Leahy), S. 1927 (Senator Carper and Senator Blunt), S. 1976 (Senator Rockefeller), and S. 1995 (Senator Blumenthal) would have given the FTC the express power to levy civil penalties on companies that fail to comply with certain data security standards. S. 1897 would have permitted the FTC to impose civil penalties for violations for failing to comply with federal cybersecurity standards. S. 1976 would have provided the FTC with explicit authority to promulgate "information security" regulations that could extend to certain non-profits. The bill would have further allowed the FTC to enforce violations of these regulations with various civil penalties. Likewise, S. 1995 would have given enforcement authority to the FTC. In several hearings related to the Target breach, some Members of Congress broached the subject of increasing the FTC's powers to pursue data breach actions. There were no similar bills in the House in the 113 th Congress.

Creating Federal Standards for Data Security, Including for Businesses

Some contend that a federal data breach notification law on its own is insufficient to combat widespread data breaches, primarily because the notification comes after the fact of a breach. Such critics advocate that in addition to data breach notification, the federal government might create standards for what represents a minimum acceptable level of data security. One study noted that a lack of clarity in terms of what precautions businesses should take to protect consumers' personal information has resulted in a patchwork of state data security standards. Though the FTC has proposed some generic guidelines, the agency arguably does not have authority to promulgate official regulations which could detail such standards more fully.

Creating a federal standard for data security has both proponents and opponents in Congress. On the one hand, critics voice concerns that a federal standard would be too rigid for such a rapidly evolving, technology-driven field as data security. They fear that a federal standard could be burdensome and could lag behind new technological trends or even discourage businesses from adopting newer technologies to prevent fraud. On the other hand, proponents of creating federal data security standards argue that such a standard need not be specific nor advocate particular technologies. According to this argument, the federal statute could, for example, consist of a mandate that an organization employ a level of data security that is "reasonable" for the size and complexity of its data operations, for the cost of available tools to reduce vulnerabilities, and for the volume and sensitivity of consumer information it holds.

Bills in both the Senate and the House appear to create differing types of federal standards for data security, along with other changes, such as data breach notification. Bills on this subject include S. 1193 , S. 1897 , S. 1976 , S. 1995 , and S. 1927 . S. 1193 and H.R. 1468 would require covered entities to "take reasonable measures to protect and secure data in electronic form containing personal information."

Section 202 of S. 1897 and H.R. 3990 would establish broad information security standards and would further authorize the FTC to establish more detailed data security regulations. Such regulations would relate to the implementation of a personal data privacy and security program, vulnerability testing of data security by firms, periodic risk assessments, and employee training on data security. To enforce these data security standards, both bills would provide for civil penalties for violations of the standards.

S. 1927 sets forth a requirement that covered entities "implement, maintain, and enforce reasonable policies and procedures to protect the confidentiality and security of sensitive account information and sensitive personal information.... " Rather than leaving it entirely to the FTC to promulgate rules on these standards, it would give that rulemaking authority, along with enforcement authority, to each institution's prudential regulator. For financial institutions, that prudential regulator would be either the Office of the Comptroller of the Currency (OCC), the Federal Reserve, or the Federal Deposit Insurance Corporation (FDIC). For institutions that are registered investment advisers, investment companies, or broker-dealers, that regulator would be the Securities and Exchange Commission. For institutions that are futures commission merchants, commodity trading advisors, commodity pool operators, or introducing brokers, the regulator would be the Commodity Futures Trading Commission. For Fannie Mae or Freddie Mac, the regulator would be the Federal Housing Finance Agency. For any other business not covered by these categories, the regulator would be the FTC.

S. 1976 would authorize the FTC to promulgate regulations providing detailed security standards and would set out four requirements for the FTC to analyze in its rulemaking, along with other requirements, such as a designated officer for information security and a written security policy regarding use and storage of personal information.

S. 1995 would set out requirements for a personal data privacy and security program and would give the FTC the right to promulgate rules further delineating these requirements. The bill requires companies to conduct risk assessments, adopt risk controls, conduct employee training in data security, and conduct periodic vulnerability assessments. It provides enforcement authority, and the right to levy civil penalties, to the Department of Justice, and in some cases, to state attorneys general, and also creates a private right of action.

The executive branch has released a voluntary framework for data security among so-called critical infrastructure industries. On February 12, 2014, the National Institute of Standards and Technology (NIST), an agency within the Department of Commerce, issued its Framework for Improving Critical Infrastructure Cybersecurity , known more commonly as The Cybersecurity Framework . While the financial sector is considered to be part of the U.S. "critical infrastructure," the retail sector is not. Thus, the "merchants" sector discussed in this report on the Target breach are not included in this voluntary framework. Target, however, owns a bank and after its data breaches used this to become the first retailer to join the financial services information sharing and analysis sector (FS-ISAC). The NIST framework is discussed in more detail in the CRS Legal Sidebar National Institute of Standards and Technology Issues Long-awaited Cybersecurity Framework . The impact of the NIST framework remains to be seen. Being voluntary, the framework contains no direct means to enforce compliance. Some have argued, however, that the existence of the framework could potentially create a basis for a standard of conduct that could possibly become a benchmark for courts to evaluate liability relating to data security under tort and other law.

Requiring Adoption of More Advanced Technologies

One issue that has been raised in hearings (but not pursued legislatively) has been the question of how costs for improved cybersecurity—including penalties and fees for breaches—are allocated across merchants, credit card companies, payment processors, and issuing and acquiring banks. This is problematic as customer PII is shared by these companies and must be protected through the payment chain. To use a simple analogy, in a house shared by several roommates, each wants to see the house kept clean, but no one wants to clean the living room. Similarly, customer information is often protected by each of these parties to the payment system at different points along the way, including by the merchant, the payment card company, the issuing and acquiring banks, and the payment processor. This creates a similar problem of participants trying to shift the costs of cyber protection to the other participants. How cybersecurity costs are allocated relates to the question of whether retailers, banks, and payment card companies have been willing to pay for, and adopt, new data security technology quickly enough.

These issues were raised in congressional hearings. Witnesses at times criticized parties representing merchants, banks, or payment card companies for inadequate payment card security, resulting in what the media called "finger-pointing." Yet it is unclear whether a superior legislative solution to this shared property problem exists. Currently, a web of negotiated agreements allocates liability for customer breaches among the various parties. Merchant trade groups, however, have complained that excessive market power of payment card companies, such as MasterCard and Visa, has forced an undue share of the costs of cybersecurity protections on the merchants, and that they also bear an unduly high share of the penalties and indemnifications to payment card companies and banks for breaches, while payment card companies are not spending enough to upgrade security technology, including moving from magnetic stripe and signature to Chip and PIN. Banks, meanwhile, have complained that they pay most of the costs to reissue cards and reimburse for fraudulent charges and that often such breaches result from merchants' security errors.

Could a legislative solution better allocate such costs compared with individually negotiated contracts? A 2010 Federal Reserve Bank of Philadelphia discussion paper interviewed many payment system participants and found that, while merchants have a vested interest in protecting data to uphold their reputations and brands, as well as to avoid chargebacks, some did not feel they had ownership over the fraud mitigation system with which they contractually have to comply. One concern voiced by banks and payment card companies was that if data security were to become a competitive factor, information sharing and cooperating on data security might be more difficult. Consumers might view competition for superior data security as desirable. While the article raised questions such as to whether the costs of payment card fraud and of avoiding such fraud are borne by the appropriate parties in the payment system, it concluded only that, "The answers to these questions are not simple."

A number of Members of Congress participating in the Target hearings raised the question of why the United States still had not moved to a Chip and PIN system (see " What Industry Best Practices Have Been Adopted? " for more information), as this technology is widely believed to make breaches more difficult. Senator Warren pressed industry representatives to explain why they had not yet adopted this Chip and PIN technology, and she suggested that government action might be warranted to encourage adoption of new technology. Senator Durbin stated that retailers and customers were actually paying one cent for each transaction to cover anti-fraud and security costs of payment cards, and questioned whether the technology upgrades were being adopted quickly enough, in light of this. But, while Members raised the question often of why more advanced technology had not yet been adopted in America, in contrast to the European Chip and PIN standard, they generally stopped short of advocating that the federal government mandate any specific technology upgrades or changes at this point in time.

Where Can I Find Additional CRS Information on Cybersecurity Issues?

CRS's reports on cybersecurity issues are in Issues Before Congress: Homeland Security and Terrorism, Cybersecurity at http://www.crs.gov/pages/subissue.aspx?cliid=4300&parentid=28&preview=False . CRS Report R42619, Cybersecurity: CRS Experts , by [author name scrubbed], lists CRS's experts in various aspects of cybersecurity.

Glossary