Target has agreed to pay $39 million to settle loss claims from a two-year-old data breach that were brought by a group of financial institutions, according to court documents filed Wednesday.
The settlement would apply to banks and other financial entities that lost money in the breach and did not give up their right to sue in an earlier settlement that Target inked with Visa. Judge Paul Magnuson of the U.S. District Court for the District of Minnesota in St. Paul gave the settlement his preliminary approval on Wednesday.
Target's breach, which took place in December 2013, exposed the credit-card data of approximately 40 million Target customers, and estimates of its ultimate cost to financial institutions run as high as $18 billion.
This is the second major settlement the Minneapolis-based retailer has reached with financial firms over the breach. It agreed to pay Visa issuers $67 million in August.
Settlements over Target's breach have been hotly opposed by some banks, who claim that they would not be fully compensated for the cost of the breach. In May, a $19 million settlement fell apart when not enough banks chose to participate in it. A group of small lenders, including the $23 billion-asset Umpqua Holdings in Portland, Ore., and the $444 million-asset Mutual Bank in Whitman, Mass., also filed a separate suit against the retailer independent of the Visa and MasterCard suits.
The agreement announced Wednesday would apply to claims brought through MasterCard as well as the separate suit by the banks. It would allow banks to be reimbursed in two ways. First, banks could submit documentation of their losses to be reimbursed from a $20.3 million fund Target set up to cover the expense of reissuing cards and other administrative costs.
The agreement also includes a $19.1 million payment into a MasterCard fund that would reimburse banks for fraudulent charges. These payments would be credited to banks' accounts based on MasterCard's analysis of losses.
The settlement announced Wednesday does not need to reach a participation threshold that doomed the previous MasterCard settlement. Also, under the new agreement, Target would not have the right to challenge MasterCard's assessment of banks' losses.
Corrected December 2, 2015 at 4:20PM: An earlier version incorrectly stated that MasterCard brought the suit.