Securities Regulation Daily Wrap Up, TOP STORY—D. Minn.: Target directors face derivative suit over holiday data breach, (Jan 23, 2014)

By Matthew Garza, J.D.

A shareholder derivative suit was filed on behalf of Target Corp., against certain directors and senior management of the company for failing to prevent a data-security breach said to be the second largest ever reported by a U.S. retailer. The suit claims the board members breached their fiduciary duties to Target shareholders and wasted corporate assets (Kulla v. Steinhafel, January 21, 2014).

Data breach. The breach took place between November 27 and December 15, 2013, but the defendants allowed the company to delay informing affected customers until December 19, and even then underestimated the size of the breach, according to the complaint. The company initially reported that the breach affected 40 million customers and then increased that number to 70 million two weeks later. The company also initially informed customers that PIN information was not affected by the data breach, but in the face of media reports claiming otherwise, later admitted that PIN information was in fact compromised.

Damages. The failure to implement internal controls to detect and prevent the security breach, and the failure to report it in a timely manner, has severely damaged Target, according to the complaint. It has also subjected the company to ongoing investigations by the Department of Justice and the U.S. Secret Service, and nine class actions seeking hundreds of millions of dollars in damages.

Duties. The complaint, which detailed each defendant’s compensation package, claimed that directors and officers violated the fiduciary obligations of trust, loyalty, good faith, and due care owed to the company and its shareholders. These duties required the defendants to: (1) maintain a system of internal controls sufficient to ensure the protection of customers’ personal and financial information; (2) ensure that the company informed customers of any breach of security accurately and in a timely manner; (3) conduct the affairs of the company “in an efficient, business-like manner” to avoid wasting the value of the company’s assets and maximize the value of its stock; and (4) remain informed of company operations and take reasonable steps to correct imprudent or unsound practices. The defendants also conspired to disguise their violations of the law, breaches of fiduciary duty, and waste of corporate assets, according to the plaintiff.

Demand. Demand on the board was futile because the conduct was not a valid exercise of business judgment and the entire board faces a substantial likelihood of liability for the conduct, according to the complaint.

The plaintiff demanded a jury trial and requested relief consisting of “the amount of damages sustained by the Company.” It also sought various changes in Target’s corporate governance practices, including a shareholder vote on a proposal to strengthen the company’s internal controls over customers’ personal and financial information, and a provision to allow shareholders to nominate at least three candidates for election to the board.

Attorneys: Christopher R. Walsh (Walsh Law Firm) and Brian J. Robbins (Robbins Arroyo LLP) for Robert Kulla.

Companies: Target Corp.

MainStory: TopStory CorporateGovernance DirectorsOfficers MinnesotaNews NewLawsuitsNews