Consumer Apps · Shopping/Retail · Private litigation + Data breach
Target
Headline
Target's landmark 2013 breach — 41 million payment card accounts, contact information for 60 million-plus customers, entered through a THIRD-PARTY HVAC VENDOR'S credentials…
Target's landmark 2013 breach — 41 million payment card accounts, contact information for 60 million-plus customers, entered through a THIRD-PARTY HVAC VENDOR'S credentials — remains the reference case for vendor-credential risk more than a decade later (the HVAC contractor was Fazio Mechanical Services). On top of that decade-old wound, Target faced a separate 2026 proposed class action (status not re-verified as of Oct 2026) alleging its coffee creamer contains FEWER SERVINGS than advertised on the label — a reminder that for a retailer this size, litigation genuinely never fully clears; new complaints just keep arriving behind the old ones.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. oag.dc.gov/release/attorney-general-racine-announces-185-million — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
ONE OF THE LARGEST RETAIL BREACHES IN US HISTORY: the 2013 Target breach exposed more than 41 MILLION payment card accounts plus contact information for more than 60 MILLION customers (per the 2017 multistate AG settlement) — hackers gained access through a THIRD-PARTY HVAC VENDOR and installed malware on Target's point-of-sale systems during the peak holiday shopping season. Target paid a $10 million consumer settlement fund (capped at $10,000/claimant) plus a SEPARATE $18.5 million settlement with 47 state attorneys general (2017).
Fees and billing
SEPARATE 2026 SETTLEMENT: Target paid up to $2.225 million to resolve claims it violated Washington State's Equal Pay and Opportunities Act by failing to disclose salary ranges/benefits in job postings (2023–2025 postings) — an employment-law issue, not a customer-privacy issue, but relevant if this audit also considers labor practices.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (TGT). Service route: c/o General Counsel / Corporate Secretary, Minneapolis, Minnesota — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. Target suffered a landmark data breach in 2013. | fact | supported | none recorded |
| 2. The breach involved 40 million cards. | fact | contradicted | 1 (0 confirmed) |
| 3. The breach involved 70 million shoppers' personal data. | fact | contradicted | 1 (0 confirmed) |
| 4. Attackers entered through a third-party vendor's credentials. | fact | supported | none recorded |
| 5. The third-party vendor was an HVAC vendor. | fact | unsupported | none recorded |
| 6. The 2013 breach is still generating fresh lawsuits in 2026 from delayed identity-theft harm. | fact | unsupported | 1 (0 confirmed) |
| 7. Target faces a separate active 2026 case alleging its coffee creamer contains fewer servings than advertised. | fact | unsupported | 1 (1 confirmed) |
| 8. For a retailer this size, litigation never fully clears. | characterization | n/a | none recorded |
1 of 8 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| regulator · 2017-05-23 oag.dc.gov/release/attorney-general-racine-announces-185-million | Claim 2 | Unassigned | corrected | “more than 41 million customer payment card accounts” Quote basis: not recorded. |
| regulator · 2017-05-23 oag.dc.gov/release/attorney-general-racine-announces-185-million | Claim 3 | Unassigned | corrected | “contact information for more than 60 million customers” Quote basis: not recorded. |
| none | Claim 6 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| court · 2026-04-24 | Claim 7 | Unassigned | confirmed | “the 35.3 oz container of the Product contains “about 500 servings.”” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy target.com/c/privacy-policy/-/N-4sr7t | Not fetched yet | NO (HTML only) |
| Terms of service target.com/c/terms-conditions/-/N-4sr7p | Not fetched yet | NO (HTML only) |
| Website target.com | Not fetched yet | — |
| Primary source https://oag.dc.gov/release/attorney-general-racine-announces-185-million Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Minnesota. Provisions of MCDPA-MN on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold Minn. Stat. § 325O.03 | threshold | source |
| Right to Question Profiling Decisions — Most Explicit in Any US State Minn. Stat. § 325O.05 | hard | source |
| Right to List of SPECIFIC Third Parties Minn. Stat. § 325O.05, subd. 1(h) | hard | source |
| Universal Opt-Out Mechanism Required Minn. Stat. § 325O.05, subd. 3 | hard | source |
| Enforcement — AG; 30-Day Cure for Entities with Documented Programs Minn. Stat. § 325O.10 | hard | source |