This report concentrates on the loss of financial data, but there have also been nonfinancial data breaches, including
Sony Corporation (PlayStation Network): 2011, 77 million names, addresses, email addresses, and other personal information; Sony Picture Entertainment: 2014, a large, but unknown number of files reportedly containing personal information, internal Sony discussions, and unreleased movies, and other; JPMorgan Chase & Co. (JPMorgan): 2014, 76 million household customer names, telephone numbers, and other information and 7 million small business records; and Tricare Management Activity: 2011, 4.9 medical records lost. Target Breach

According to Target, in November and December of 2013, information on 40 million payment cards (i.e., credit, debit, and ATM cards) and personally identifiable information (PII) on 70 million customers was compromised. December 19, 2013—Target made a public announcement of the breach. January 10, 2014—Target announced the PII theft. JPMorgan Chase & Co. Home Depot reports that at least 44 legal actions in the United States and Canada had been filed against it as a result of the data breach. Home Depot reported $5.4 billion in net earnings for the fiscal year ending February 2, 2014. How Does the Payment Card System Work? 2. According to research by the Ponemon Institute, factors influencing the losses in data breaches include industry, existence of a privacy and data protection security policy, the type of information handled, the most likely cause of a data breach, whether data are stored on laptops or removable devices, whether data are encrypted, whether there is a full-time information security manager, number of employees, where in the world the company operates, policies concerning remote access to sensitive data, user authentication technology, headquarters location, and the number of sensitive records. Table 1 summarizes various estimates of the cost to Target its data breach. This section of the report continues by looking at who bears the various costs of the payment breach in the first instance. It also examines the costs to the party breached. In data breaches such as Target's, who is liable for the costs associated with such data breaches depends on a web of individual contracts among retailers, the banks that issue cards and handle payments, credit card companies such as Visa and MasterCard, payment processors authorized by the credit card companies to process payments at the point of sale, and even contracts between a retailer and its third-party service provider (such as Target's HVAC contractor). In sum, courts have been called upon to play key roles in deciding who should bear losses from data breaches like Target's. To date, congressional hearings on the Target breaches have tended to focus more on policy solutions, such as notifying consumers that data breaches have occurred, and increasing or clarifying the FTC's authority to sanction lax data security practices. This section discusses selected policy options that have been raised in congressional hearings held on data security and breaches following the Target breach. Passing a Federal Data Breach Notification Law

In each of the hearings related to the Target breach, various Members of Congress raised the possibility of a federal data breach notification law. Bills were introduced in the 113 th and earlier Congresses that would include some form of federal notification requirement for data security breaches. However, certain sectors are subject to cybersecurity obligations that may include data security. Generally, data breach notification laws include several components and address topics such as (1) which entities must comply with the law; (2) what information is being protected, and how a security breach or data breach is defined; (3) what degree of actual harm must occur, if any, for notice to be triggered; (4) how and when must notice be delivered; (5) are there any exceptions or safe harbors; (6) to what degree does this preempt state law and how does the law relate to other federal laws; and (7) what penalties, enforcement authorities, and remedies for those harmed does it create. 3990 ) addressed these elements in various ways. Modifying Federal Trade Commission Statutory Powers

Some in Congress have called for passage of a law to strengthen the Federal Trade Commission's (FTC's) statutory authority to penalize businesses that fail to adequately protect consumers' personally identifiable information. The FTC has asked Congress to pass legislation making explicit its authority in this area. In several hearings related to the Target breach, some Members of Congress broached the subject of increasing the FTC's powers to pursue data breach actions. Creating a federal standard for data security has both proponents and opponents in Congress. How cybersecurity costs are allocated relates to the question of whether retailers, banks, and payment card companies have been willing to pay for, and adopt, new data security technology quickly enough. These issues were raised in congressional hearings.
In November and December of 2013, cybercriminals breached the data security of Target, one of the largest U.S. retail chains, stealing the personal and financial information of millions of customers. On December 19, 2013, Target confirmed that some 40 million credit and debit card account numbers had been stolen. On January 10, 2014, Target announced that personal information, including the names, addresses, phone numbers, and email addresses of up to 70 million customers, was also stolen during the data breach. A report by the Senate Committee on Commerce in March 2014 concluded that Target missed opportunities to prevent the data breach.
Target. To date, Target has reported data breach costs of $248 million. Independent sources have made back-of-the-envelope estimates ranging from $240 million to $2.2 billion in fraudulent charges alone. This does not include additional potential costs to consumers concerned about their personal information or credit histories; potential fines or penalties to Target, financial institutions, or others; or any costs to Target related to a loss of consumer confidence. The breach was among the largest in U.S. history.
Consumer concern over the scale of this data breach has fueled further congressional attention on the Target breach and data security and data breaches more broadly. In the wake of Target's revelations, between February 3 and April 2, 2014, Congress held seven hearings by six different committees related to these topics. In addition to examining the events surrounding the Target breach, hearings have focused on preventing such data breaches, improving data security standards, protecting consumers' personal data, and notifying consumers when their data have been compromised.
Other financial data breaches. In addition to Target, there have been data breaches at Home Depot, JPMorgan Chase, Sony, and Adobe. Payment card information was obtained at Adobe and Home Depot. Hackers downloaded a wide range of company confidential information at Sony, and they obtained contact information in the JPMorgan Chase breach.
Policy options discussed in these hearings include federal legislation to require notification to consumers when their data have been breached; potentially increase Federal Trade Commission (FTC) powers and authorities over companies' data security; and create a federal standard for the general quality or reasonableness of companies' data security. The hearings also broached the broader question of whether the government should play a role in encouraging or even requiring companies to adopt newer data security technologies.
None of the legislation introduced in the 113th Congress that addressed these various issues became law. In 2014 and 2015, the Obama Administration encouraged Congress to pass legislation on data security and data breach notification. Attorney General Eric Holder issued a public statement in the wake of the Target breach on February 24, 2014, that urged Congress to pass a federal data breach notification law, which would hold entities accountable when they fail to keep sensitive information safe. The FTC also called on Congress to pass a federal data security law, including data breach notification and to increase the commission's explicit statutory authority over data security issues.
Key questions. This report answers some frequently asked questions about the Target and selected other data breaches, including what is known to have happened in the breach, and what costs may result. It also examines some of the broader issues common to data breaches, including how the payment system works, how cybersecurity costs are shared and allocated within the payment system, who bears the losses in such breaches more generally, what emerging cybersecurity technologies may help prevent them, and what role the government could play in encouraging their adoption. The report addresses policy issues that were discussed in the 113th Congress to deal with these issues.
Updating. This report will be updated as warranted by legislative action in the 114th Congress and by further payment system developments.