Target CEO Gregg Steinhafel steps down in wake of huge data breach

Target Chief Executive Gregg Steinhafel is leaving the retailer after a massive data breach during the critical holiday season jeopardized the personal information of up to 110 million customers and caused the company’s sales to plunge.

“After extensive discussions” with the Minneapolis company’s board, Steinhafel stepped down as chief executive, president and board member after 35 years with the brand, according to a statement issued by the board Monday.

“We are grateful to him for his tireless leadership,” the statement says.

Target stock was down nearly 3% or $1.83 to $60.18 a share in morning trading.

As the company searches for a permanent replacement, Chief Financial Officer John Mulligan will act as interim president and chief executive while Roxanne S. Austin, a board member, will serve temporarily as nonexecutive board chairwoman.

Steinhafel will be an advisor to Target -- which has 1,789 U.S. stores and 127 Canadian locations -- during the transition. He became chief executive in 2008 and has since introduced fresh groceries and smaller-scale City Target store models.

The board credited Steinhafel with guiding Target through “unprecedented challenges” during his tenure, including the financial crisis and the recession that followed, a difficult expansion into Canada and a proxy battle fought in public view.

The board said Steinhafel “held himself personally accountable” for the data breach, which the company first disclosed nearly five months ago.

On Dec. 19, Target said that up to 40 million payment card accounts had been illegally accessed since the Black Friday shopping bonanza over the Thanksgiving weekend.

Then, on Jan. 10, the retailer said that hackers had stolen personal information such as phone numbers and email addresses from up to 70 million customers.

The fallout from the crisis has been severe. Target’s revenue during the Christmas quarter slid 5%, even after the company threw assurances and discounts at customers.

The company said it incurred $61 million in hacking-related expenses, though $17 million of that was expected to be covered by insurance.

In the past month, Target has made several changes to shore up its security systems.

MasterCard will provide Target’s branded credit and debit cards, switching from Visa early next year. The new cards will be fitted with a more secure chip-and-pin technology instead of relying on the current magnetic stripe system.

Target also hired security and retail veteran Bob DeRodes to be chief information officer, succeedingBeth Jacob, who resigned from the position two months ago. The company said it is still looking for a chief information security officer and chief compliance officer.