Target Data Breach 2013: What Was Exposed and Settlement
Attackers got in through a third-party vendor’s login, then reached the customer database.
By Siddharth ShankarUpdated October 23, 2026In a multistate settlement of $18.5 million, Target resolved claims over its 2013 data breach. According to the District of Columbia attorney general, which joined 46 states, the attack on or about November 12, 2013 affected more than 41 million customer payment card accounts and exposed contact information for more than 60 million customers. Attackers used login credentials taken from a third-party vendor, reached a customer service database and installed malware. Target agreed to a security program, an independent assessment and network segmentation.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
The Target breach is one of the best-known retail data breaches in the United States. It is also a clear example of how an attacker can use a smaller partner to reach a larger target.
What the settlement was
The attorney general of the District of Columbia announced an $18.5 million multistate settlement with Target Corporation over the company’s 2013 data breach. The District joined 46 states, and the District’s own share was $168,972.71. The settlement was reached in 2017.
When it happened and how many people were affected
The attack took place on or about November 12, 2013. According to the attorney general, it affected more than 41 million customer payment card accounts. The attackers also obtained contact information for more than 60 million customers.
How the attackers got in
The settlement announcement says attackers used login credentials stolen from a third-party vendor to access Target’s gateway server. From there they exploited weaknesses in Target’s systems to reach a customer service database, install malware and capture customer data. This is why security teams now pay close attention to the access they give to suppliers.
What data was stolen
The announcement lists names, telephone numbers, email addresses, mailing addresses, payment card numbers, expiration dates, CVV1 codes and encrypted debit card PINs. Contact details like these can be used for phishing long after a card has been replaced. Read what each type of breached data means.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
What Target agreed to do
Under the settlement, Target agreed to:
- develop, implement and maintain a comprehensive information security program;
- employ an executive or officer responsible for that program;
- hire an independent, qualified third party to run a comprehensive security assessment;
- maintain and support the software on its network;
- maintain appropriate encryption policies, especially for cardholder and personal data;
- separate its cardholder data environment from the rest of its network;
- control network access, including password rotation and two-factor authentication for certain accounts.
What to do after a payment card breach
- Check your statements. Look at every transaction on the affected card and report anything unfamiliar to your card issuer straight away.
- Replace the card if offered. Issuers can cancel and reissue a card number quickly.
- Review your credit reports. You can get them free; see how to get your free credit reports.
- Consider a freeze. Our guide on credit freezes and fraud alerts explains when each helps.
- Treat unexpected messages with care. Names, phone numbers and email addresses can be used to make fake messages look genuine.
Why old breaches still matter
Contact details do not expire the way a card does. Someone whose name, email and phone number were exposed in 2013 may still receive tailored scams today. Our guide on whether to worry about an old breach helps you judge the risk.
Similar cases
Compare this with the Equifax settlement and the British Airways card skimming case. Both show how payment and personal data can be taken at scale.
Sources
- Office of the Attorney General for D.C.: Attorney General Racine announces $18.5 million multistate settlement with Target Corporation over 2013 data breach (settlement, records affected, attack method, terms)
Frequently asked questions
How much was the Target settlement?
$18.5 million in a multistate settlement. The D.C. attorney general says the District joined 46 states.
How many people were affected by the Target breach?
More than 41 million customer payment card accounts and contact information for more than 60 million customers.
How did attackers get into Target’s network?
They used login credentials stolen from a third-party vendor to reach a gateway server, then a customer service database.
What data was stolen?
Names, phone numbers, email and mailing addresses, payment card numbers, expiration dates, CVV1 codes and encrypted debit card PINs.
What should I do after a card breach?
Check statements, replace the card, review your credit reports, consider a freeze and be cautious with unexpected messages.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.