Replacing Cards In Target Hack Has Cost Banks $200 Million So Far

The cost of last year’s cyber-attack on Target TGT has already exceeded $200 million. This has nothing to do with fines or lawsuits, or even Target. This is the cost banks and credit unions are bearing as they replace hacked credit and debit cards, according to The Verge.

The Consumer Bankers Association (CBA) and the Credit Union National Association (CUNA) have replaced more than half the credit and debit cards affected. To date, that’s 21.8 million cards.

CBA has spent $172 million and CUNA, $30.6 million. Not yet calculated were the costs to financial institutions that were not members of CBA or CUNA. As the number of cards replaced rises, so will the costs.

Ultimately, who will pay for this and other costs remained to be seen. The finger pointing has only just begun. The Wall Street Journal said Februay 14 that members of Target’s security staff raised concerns about vulnerabilities in the company’s payment card system, but were “brushed off” at least two months before the attacks. If true that does not bode well for Target.

Related: Target Set To Lead The Way On Chip And Pin Credit Card Technology

The stakes are high. The final cost of this breach could reach $18 billion, according to The New York Times. The various players, in addition to Target, include Target sub-contractor, Fazio Mechanical Services that, investigators believe, was the portal through which the hackers gained access to Target’s system.

Target, of course, would be the natural initial “target” for any lawsuits over the security breakdown. Companies that help Target process payments could also face fines.

When a customer makes a credit or debit card purchase at Target (or any other major store), typically several different companies could be involved in the transaction.

Although a bank usually issues the card, an organization known as a "merchant acquirer" takes on the payment for the store, in this case, Target.

Companies like Visa V and MasterCard MA run the networks over which the payment and confirmation travel.

One Target “merchant acquirer” was identified as Bank of America Merchant Services.

Another company identified as a transaction partner was Vantiv.

Toronto’s TD Bank Group, a subsidiary of the Toronto-Dominion Bank, issues target’s in-house credit cards.

Any, all, or none of these companies could eventually wind up responsible for some of the costs related to this event.

Meanwhile, millions of dollars in expenses continued to pile up for banks and credit unions related to nothing more than replacing vulnerable cards.

At the time of this writing, Jim Probasco had no position in any mentioned securities.