McDonald Hopkins' Data Privacy and Network Security Group first alerted our clients and friends of the massive data breach at Global Payments, Inc. in April 2012 (click here for Alert). The Atlanta-based payments processor has now revealed that the breach cost the company $93.9 million.
From inception of the incident, Global Payments estimated 1.5 million accounts were exposed by the breach, but other reports suggested the breach could have affected as many as 7 million Visa and MasterCard accounts. In June, the company expanded the number of affected accounts, but never said by how many. In its recent filing, Global Payments noted that, "We cannot verify those potentially affected, as it is unclear whether any information was exported . . . [h]owever, we notified potentially affected individuals and made available credit monitoring and identity protection insurance at no cost."
In reporting its costs related to the incident, Global Payments provided the following breakdown of specific expenses and recoveries:
- $60 million for professional fees and other costs associated with the investigation and remediation, incentive payments to certain business partners and costs associated with credit monitoring and identity protection insurance;
- $35.9 million for the total of estimated fraud losses, fines and other charges that will be imposed by the card networks; and
- $2 million received for insurance recoveries, based on claims submitted to date.
Global Payments anticipates that additional costs may be $25 to $35 million in fiscal year 2013 (prior to any potential insurance recovery).