XML 22 R8.htm IDEA: XBRL DOCUMENT v2.4.0.8
Commitments and Contingencies
9 Months Ended
Nov. 02, 2014
Commitments and Contingencies Disclosure [Abstract]  
Commitments and Contingencies
COMMITMENTS AND CONTINGENCIES
Data Breach
In the third quarter of fiscal 2014, the Company confirmed that its payment data systems were breached, which could potentially impact customers who used payment cards at the Company's U.S. and Canadian stores (the “Data Breach”). The Company's investigation to date has determined the intruder used a vendor’s user name and password to enter the perimeter of the Company’s network. The intruder then acquired elevated rights that allowed it to navigate portions of the Company’s network and to deploy unique, custom-built malware on the Company’s self-checkout systems to access payment card information of customers who shopped at the Company's U.S. and Canadian stores between April 2014 and September 2014. The investigation of the Data Breach is ongoing, and the Company is supporting law enforcement efforts to identify the responsible parties.
The Company has completed a major payment security project that provides enhanced encryption of payment card data at the point of sale in all of the Company's U.S. stores, offering significant new protection for customers. The new security protection takes raw payment card information and scrambles it to make it unreadable to unauthorized users. Roll-out of enhanced encryption to Canadian stores will be completed by early 2015. The Company is also rolling out EMV chip-and-PIN technology in its U.S. stores, which adds extra layers of payment card protection for customers. Canadian stores are already enabled with EMV chip-and-PIN technology.
Expenses Incurred
In the third quarter of fiscal 2014, the Company recorded $43 million of pretax expenses related to the Data Breach, partially offset by a $15 million receivable for costs the Company believes are reimbursable and probable of recovery under its insurance coverage, for pretax net expenses of $28 million. These expenses are included in Selling, General and Administrative expenses in the accompanying Consolidated Statements of Earnings for the three and nine months ended November 2, 2014. Expenses include costs to investigate the Data Breach; provide identity protection services, including credit monitoring, to impacted customers; increase call center staffing; and pay legal and other professional services, all of which were expensed as incurred.
Litigation, Claims and Government Investigations
In addition to the above expenses, the Company believes it is probable that the payment card networks will make claims against the Company. The ultimate amount of these claims will likely include amounts for incremental counterfeit fraud losses and non-ordinary course operating expenses (such as card reissuance costs) that the payment card networks assert they or their issuing banks have incurred. In order for the Company to have liability for such claims, the Company believes it would have to be determined, among other things, that (1) at the time of the Data Breach the portion of the Company’s network that handles payment card data was noncompliant with applicable data security standards, and (2) the alleged noncompliance caused at least some portion of the compromise of payment card data that occurred during the Data Breach. Although an independent third-party assessor found the portion of the Company’s network that handles payment card data to be compliant with applicable data security standards in the fall of 2013, the process of obtaining such certification for 2014 was ongoing at the time of the Data Breach and the forensic investigator working on behalf of the payment card networks may claim that the Company was not in compliance with those standards at the time of the Data Breach. As a result, the Company believes it is probable that the payment card networks will make claims against it and that the Company will dispute those claims. When those claims are asserted, the Company will have to determine, based on the facts and information then available to it, whether to litigate or seek to settle those claims. At this time, the Company believes it is probable that the claims will be asserted and that settlement negotiations will ensue, and believes that a loss in connection with these claims is reasonably possible. The Company cannot reasonably estimate a range of possible losses because no claims have yet been asserted and because there are significant factual and legal issues to be resolved. The Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. The Company believes it is reasonably possible that the ultimate amount paid on payment card network claims could be material to the Company's consolidated financial condition, results of operations, or cash flows in future periods.
In addition, at least 44 actions have been filed in courts in the U.S. and Canada, and other claims may be asserted against the Company on behalf of customers, payment card brands, payment card issuing banks, shareholders or others seeking damages or other related relief, allegedly arising from the Data Breach. Furthermore, several state and federal agencies, including State Attorneys General, are investigating events related to the Data Breach, including how it occurred, its consequences and the Company's responses. The Company is cooperating in the governmental investigations, and the Company may be subject to fines or other obligations. While a loss from these matters is reasonably possible, the Company is not able to estimate the costs, or range of costs, related to these matters because the proceedings remain in the early stages, alleged damages have not been specified, there is uncertainty as to the likelihood of a class or classes being certified or the ultimate size of any class if certified, and there are significant factual and legal issues to be resolved. The Company has not concluded that a loss from these matters is probable; therefore, the Company has not recorded an accrual for litigation, claims and governmental investigations in the third quarter of fiscal 2014. The Company will continue to evaluate information as it becomes known and will record an estimate for losses at the time or times when it is both probable that a loss has been incurred and the amount of the loss is reasonably estimable. The Company believes that it is reasonably possible that the ultimate amount paid on these actions, claims and investigations could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.
Future Costs
The Company expects to incur significant legal and other professional services expenses associated with the Data Breach in future periods. The Company will recognize these expenses as services are received. Costs related to the Data Breach that may be incurred in future periods may also include credit card fraud and card reissuance costs for the Company's private label credit card program, as well as incremental expenses and capital investments for remediation activities. The Company believes that it is reasonably possible that the ultimate amount paid on these services and claims could be material to the Company’s consolidated financial condition, results of operations, or cash flows in future periods.
Insurance Coverage
The Company maintains $100 million of network security and privacy liability insurance coverage, above a $7.5 million deductible, to limit the Company's exposure to losses such as those related to the Data Breach. As of November 2, 2014, the Company has recorded a receivable of $15 million for costs the Company has incurred to date that it believes are reimbursable and probable of recovery under its insurance coverage.