Target sues insurer for up to $74 million in 2013 data breach costs

Target is suing its longtime insurance company for denying claims to reimburse Target for tens of millions of dollars it has paid out for new payment cards as part of settlements over the retailer's 2013 data breach.

The lawsuit against ACE American Insurance Co., based in Pennsylvania and now part of the Chubb Corp., was filed Friday in U.S. District Court in Minnesota.

In it, Target notes that it has paid out a total of $138 million, including attorneys' fees, to banks to settle claims related to its data breach. While some of the costs were paid for or reimbursed by insurers, the Minneapolis-based retailer said at least $74 million that it paid to settle claims over the costs of replacing payment cards has not been picked up by insurers.

Target argues that its general liability policy with ACE should have covered those costs because the policy defines property damage as including "loss of tangible property that is not physically injured."

"That is precisely this case," Target said in the lawsuit. "Target was held liable for the loss of use of plastic payment cards that were not physically injured."

A spokesman for Chubb said Tuesday that the company does not comment on pending litigation.

In a statement, Target said it had been in discussions with ACE over this issue for more than a year before filing the lawsuit.

Target's data breach in November 2013 was one of the biggest data breaches of its kind at the time, but has since been followed by many others. A hacker installed software on Target's computer network and was able to glean the payment card information of 40 million customers and the personal information of 60 million customers.

"As a result, numerous banks were required to dedicate substantial resources to canceling and reissuing physical payment cards," Target said in its lawsuit. "These costs include, for example, the cost of producing the plastic card, mailing the card to consumers and otherwise reiussing the physical card."

The banks then started suing Target for their losses. Target contacted ACE in January 2014 after the first lawsuits from banks started coming in. ACE initially denied Target's request for coverage of payment card claims in March 2014, according to the suit. ACE has continued to refuse to cover those claims.

In the suit, Target noted that it reached a settlement in a class-action lawsuit brought by banks for about $58 million in May 2016. It also reached confidential settlements with major card issuers such as Visa, Mastercard, American Express, Discover as well as a number of individual banks.

In total, Target has reported that it incurred about $292 million in expenses related to its data breach, about $90 million of which were offset by insurance.

Kavita Kumar • 612-673-4113