Attorney General Josh Shapiro today announced that the Neiman Marcus Group LLC has agreed to pay $1.5 million and implement a number of policies to resolve an investigation with 43 states and the District of Columbia into the 2013 breach of customer payment card data at 77 Neiman Marcus stores in the United States.

In January 2014, Neiman Marcus disclosed that payment card data collected at certain retail stores had been with Pennsylvania consumers – were compromised in the breach, which took place over the course of several months in 2013. At least 9,200 of the payment cards compromised in the breach nationally were used fraudulently.  Pennsylvania’s share of the settlement funds is $42,997 and will go to the Pennsylvania Treasury.

[uam_ad id=”54865″]

“Data breaches are a top priority of my Office, and I am proud to announce this victory for consumers in Pennsylvania and across the nation as we continue to read headlines about breaches of customer information from companies entrusted to protect it,” said Attorney General Shapiro.  “One of the best defenses against these types of fraud and identity theft is to monitor your credit rating, credit card statements and bank accounts regularly, and I urge consumers to take action to protect themselves.  My Office is working to change corporate behavior and seek justice on behalf of Pennsylvanians whose data has been compromised.”

In addition to the monetary settlement, Neiman Marcus has agreed to a number of injunctive provisions aimed at preventing similar breaches in the future, including:

• Complying with Payment Card Industry Data Security Standard (PCI DSS) requirements;
• Maintaining an appropriate system to collect and monitor its network activity, and ensuring logs are regularly reviewed and monitored;
• Maintaining working agreements with two, separate, qualified Payment Card Industry forensic investigators;
• Updating all software associated with maintaining and safeguarding personal information, and creating written plans for replacement or maintenance of software that is reaching its end-of-life or end-of-support date;
• Implementing appropriate steps to review industry-accepted payment security technologies relevant to the company’s business; and
• Devaluing payment card information, using technologies like encryption and tokenization, to obfuscate payment card data.

Under the settlement, Neiman Marcus is also required to retain a third-party professional to conduct an information security assessment and report, and to detail any corrective actions that the company may have taken or plans to take as a result of the third-party report.

Please click here to view the settlement document.

[uam_ad id=”54875″]