Target

Disclosed Dec 19, 201341,000,000 affectedSettled

2013 breach of 41M payment cards and 60M contacts; USD 18.5M multistate settlement

Target's 2013 data breach affected more than 41 million customer payment card accounts and exposed contact information for more than 60 million customers. In 2017, 47 states and DC reached a USD 18.5M settlement, then the largest multistate data breach settlement.

What is known

People affected	41,000,000 (as reported by the organization)
Disclosed	Dec 19, 2013
Discovered	Dec 2013
Happened	Nov 27, 2013
Attack	Hacking
Data exposed	Payment cardsNamesAddressesPhone numbersEmails
Sector	Retail · US
Status	Settled
Lawsuit or fine	USD 18.5M 47-state AG settlement (May 2017) (about $19M)

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Target

Regulatoroag.ca.gov

Attorney General Becerra: Target Settles Record $18.5 Million Credit Card Data Breach Case

SEC filingsec.gov

Target Corp Form 10-K for fiscal 2013

Newsusatoday.com

Target confirms encrypted PIN data stolen

Regulatorag.ny.gov

NY AG: Letter to Target regarding data breach

Regulatorag.ny.gov

NY AG: USD 18.5 Million Multi-State Settlement With Target

Official noticemaine.gov

Maine Attorney General breach notice archive: Target

Notices filed

TotalDec 19, 2013

Research70,000,000 people

TotalDec 19, 2013

Research41,000,000 people

Residents of MEDec 19, 2013

Maine AG115,000 people

Residents of CADec 20, 2013

California AGCount not stated

Residents of MEMar 20, 2014

Maine AG2,871 people

Residents of MEJun 24, 2014

Maine AG89 people

History of this record

source2026-09-25

empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsxby backfillSource

lawsuit2026-09-25

$18.5M multistate attorneys general settlement (2017) to USD 18.5M 47-state AG settlement (May 2017)by seedSource

records2026-09-25

70000000 to 41000000by seedSource

summary2026-09-25

Malware on Target's US point-of-sale registers stole payment card data from about 40 million card accounts between November 27 and December 15, 2013, and the intruder also took names, addresses, phone numbers or emails for up to 70 million to Target's 2013 data breach affected more than 41 million customer payment card accounts and exposed contact information for more than 60 million customers. In 2017, 47 states and DC reached a USD 18.5M settlement, then the largest multistateby seedSource

title2026-09-25

POS malware steals 40 million payment cards and data on 70 million guests to 2013 breach of 41M payment cards and 60M contacts; USD 18.5M multistate settlementby seedSource

status2026-09-25

confirmed to settledby seedSource

fine_usd2026-09-25

empty to 18500000by seedSource

lawsuit2026-09-25

empty to $18.5M multistate attorneys general settlement (2017)by seedSource

sector2026-09-25

tech to retailby seedSource

attack2026-09-25

unknown to hackingby seedSource

data_types2026-09-25

[] to ["payment-card","names","addresses","phone","emails"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 70000000by seedSource

disclosed2026-09-25

2013-12-20 to 2013-12-19by seedSource

discovered2026-09-25

empty to 2013-12by seedSource

summary2026-09-25

empty to Malware on Target's US point-of-sale registers stole payment card data from about 40 million card accounts between November 27 and December 15, 2013, and the intruder also took names, addresses, phone numbers or emails for up to 70 million by seedSource

title2026-09-25

empty to POS malware steals 40 million payment cards and data on 70 million guestsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Target