Retail breaches cost $2.96M on average. Per record, $142.

The simple answer is that card data has a finite useful life to the attacker. A stolen credit card number ages out within days or weeks of detection as issuers cancel and reissue. Cardholders are statutorily protected from fraud liability beyond $50 under the Fair Credit Billing Act. The attacker has a narrow window of monetization, the issuer absorbs the fraud cost, and the cardholder experiences inconvenience rather than direct loss. None of that is true for stolen PHI, SSN, or genome data, which retain value indefinitely because they cannot be revoked.

For the retailer, the cost components that dominate are PCI DSS card-brand assessments (which run $5,000 to $100,000 per month per merchant ID for compliance failures), card reissuance reimbursement to issuers ($5 to $15 per card multiplied by the affected count), forensic investigation by a PCI Forensic Investigator (PFI, $200K to $2M typical), and customer-relationship investment to maintain visit frequency post-breach. Class-action exposure is real but typically settles at $5 to $50 per consumer for card-data-only breaches, materially lower than the $30 to $150 typical in PHI breaches.

Where retail breach cost can climb sharply is when the breach exposes data beyond card numbers. The 2013 Target breach is the canonical example. The headline 40M stolen card records were the smaller cost component. The 70M customer records (name, address, phone, email) exposed in the same intrusion drove higher cost than the cards themselves, because that data did not age out and triggered state breach-notification obligations in 47 states.

PCI DSS (Payment Card Industry Data Security Standard) is the compliance framework that applies to any organisation that stores, processes, or transmits cardholder data. The standard is owned by the PCI Security Standards Council jointly created by Visa, Mastercard, American Express, Discover, and JCB, but enforcement flows through the card brands directly via the acquiring-bank relationship.

PCI levels are determined by annual transaction volume. Level 1 (over 6 million transactions per year, or any merchant that has suffered a breach) requires annual on-site assessment by a Qualified Security Assessor at a cost of $50K to $250K, plus quarterly external vulnerability scanning. Level 2 (1M to 6M transactions) requires annual self-assessment with QSA review. Levels 3 and 4 require annual self-assessment questionnaires only. The cost of staying compliant runs $50K to $1M annually for a mid-sized retailer, and rises sharply post-breach because the retailer is automatically promoted to Level 1.

The card-brand fines for breach are structured as compliance penalties rather than damages. Visa publishes a confidential schedule that public-record settlements indicate runs $5,000 to $50,000 per month per merchant ID for an Account Data Compromise Event, scaling with the number of compromised accounts and the merchant's historical compliance posture. Mastercard, Amex, and Discover have parallel structures. For a Tier 1 retailer with multi-month exposure, monthly fines alone can run into seven figures before per-card reissuance reimbursement is added.